/**
 * @fileoverview AuditLogService — immutable chained audit log.
 *
 * Computes SHA-3 content hashes, links entries via previousEntryHash,
 * signs with the node operator's key, and optionally persists to the
 * block store via storeCBLWithWhitening.
 *
 * @see Design: Immutable Chained Audit Log
 * @see Requirements 13.6, 13.7
 */
import { ECIESService, Member, PlatformID } from '@digitaldefiance/ecies-lib';
import { BrightTrustAuditLogEntry } from '../interfaces/auditLogEntry';
import { ChainedAuditLogEntry } from '../interfaces/chainedAuditLogEntry';
import { IBrightTrustDatabase } from '../interfaces/services/brightTrustDatabase';
import { CBLStorageResult } from '../interfaces/storage/cblWhitening';
/**
 * Callback interface for persisting audit entries to the block store.
 * Implementations live in brightchain-api-lib where the actual block store is available.
 */
export interface IAuditBlockStorePersistence {
    /**
     * Store serialized audit entry data via storeCBLWithWhitening.
     * @param data - Serialized chained audit entry
     * @returns The CBL storage result with blockId1 and blockId2
     */
    storeCBLWithWhitening(data: Uint8Array): Promise<CBLStorageResult>;
    /**
     * Retrieve a stored audit entry from the block store.
     * @param blockId1 - First CBL block ID
     * @param blockId2 - Second CBL block ID
     * @returns The reconstructed data
     */
    retrieveCBL(blockId1: string, blockId2: string): Promise<Uint8Array>;
}
/**
 * Serializes an audit log entry (excluding signature and blockIds) into
 * a deterministic JSON string suitable for hashing.
 *
 * Fields are sorted alphabetically to ensure deterministic output.
 * The `signature`, `blockId1`, and `blockId2` fields are excluded
 * since they are computed after the content hash.
 */
export declare function serializeEntryForHashing(entry: BrightTrustAuditLogEntry<PlatformID> & {
    previousEntryHash?: string | null;
}): string;
/**
 * Compute the SHA-3-512 content hash of a serialized entry string.
 * Returns the hash as a hex string.
 */
export declare function computeContentHash(serialized: string): string;
/**
 * AuditLogService creates tamper-evident chained audit log entries.
 *
 * Each entry is:
 * 1. Serialized deterministically (excluding signature/blockIds)
 * 2. Hashed with SHA-3-512 to produce contentHash
 * 3. Linked to the previous entry via previousEntryHash
 * 4. Signed by the node operator's key
 * 5. Optionally persisted to the block store via storeCBLWithWhitening
 * 6. Stored in the database audit_log collection
 *
 * @template TID - Platform ID type for frontend/backend DTO compatibility
 */
export declare class AuditLogService<TID extends PlatformID = Uint8Array> {
    private readonly db;
    private readonly signingMember;
    private readonly eciesService;
    private readonly blockStore?;
    constructor(db: IBrightTrustDatabase<TID>, signingMember: Member<TID>, eciesService: ECIESService, blockStore?: IAuditBlockStorePersistence | undefined);
    /**
     * Append an audit entry to the chained log.
     *
     * 1. Fetches the latest entry to get previousEntryHash
     * 2. Computes contentHash = SHA-3(serialized entry excluding signature/blockIds)
     * 3. Signs contentHash with the node operator key
     * 4. Optionally stores via storeCBLWithWhitening
     * 5. Persists the chained entry to the database
     *
     * @param entry - The base audit log entry to append
     * @returns The fully chained audit log entry
     */
    appendEntry(entry: BrightTrustAuditLogEntry<TID>): Promise<ChainedAuditLogEntry<TID>>;
    /**
     * Verify the integrity of the entire audit chain.
     *
     * Walks backward from the latest entry:
     * 1. Recomputes contentHash from entry fields
     * 2. Verifies signature against the signing node's public key
     * 3. Optionally retrieves from block store and confirms match
     * 4. Verifies previousEntryHash links
     * 5. Detects tampering at any point
     *
     * @param signerPublicKey - The public key of the node that signed the entries
     * @param entries - The full chain of entries to verify (ordered newest-first or oldest-first)
     * @returns True if the chain is valid
     * @throws BrightTrustError with AuditChainCorrupted if tampering is detected
     */
    verifyChain(signerPublicKey: Uint8Array, entries: ChainedAuditLogEntry<TID>[]): Promise<boolean>;
}
//# sourceMappingURL=auditLogService.d.ts.map