/**
 * Compliance Logger
 *
 * Structured logging for compliance events, separate from operational audit logs.
 * Implements hash-chaining for tamper detection and supports 7-year retention (CSSF).
 *
 * Added by Pantheon Security for enterprise compliance support.
 */
import type { ComplianceEvent, ComplianceEventCategory, ComplianceActor, ComplianceResource, LegalBasis, DataCategory } from "./types.js";
/**
 * Compliance Logger class
 */
export declare class ComplianceLogger {
    private static instance;
    private complianceDir;
    private enabled;
    private retentionYears;
    private lastHash;
    private constructor();
    /**
     * Get singleton instance
     */
    static getInstance(): ComplianceLogger;
    /**
     * Ensure compliance directory exists
     */
    private ensureComplianceDir;
    /**
     * Get the current log file path (monthly rotation)
     */
    private getLogFilePath;
    /**
     * Read the last event's hash from a specific log file, or null if the file is
     * absent/empty/unreadable.
     */
    private readLastHashFromFile;
    /**
     * Return the last hash from the most recent monthly file before the current
     * one, so a fresh month seeds its chain from the prior month rather than
     * forking a new chain at month rollover (L49).
     */
    private findPreviousMonthLastHash;
    /**
     * Load the last hash to continue the chain. Prefer the current month's file;
     * if it is empty/absent (month rollover), seed from the previous month's last
     * hash so cross-month gaps don't fork the chain and trigger a false tamper signal.
     */
    private loadLastHash;
    /**
     * Create a compliance event
     */
    private createEvent;
    /**
     * Write event to log file.
     *
     * The chain link (previous_hash), hash computation, append, and lastHash
     * advance all happen inside a single withLock critical section so that
     * concurrent processes / calls serialize their appends and never fork the
     * hash chain (L49, mirrors audit-logger H20). The on-disk tail is treated as
     * the source of truth for previous_hash, re-seeding from the file (including a
     * prior-month seed on rollover) so a stale in-memory pointer cannot break the
     * chain after another process appended.
     */
    private writeEvent;
    /**
     * Log a compliance event
     */
    log(category: ComplianceEventCategory, eventType: string, actor: Partial<ComplianceActor>, outcome: "success" | "failure" | "pending", options?: {
        resource?: ComplianceResource;
        details?: Record<string, unknown>;
        legalBasis?: LegalBasis;
        dataCategories?: DataCategory[];
        retentionDays?: number;
        failureReason?: string;
    }): Promise<ComplianceEvent>;
    /**
     * Log consent event
     */
    logConsent(action: "granted" | "revoked" | "updated", actor: Partial<ComplianceActor>, purposes: string[], success: boolean, details?: Record<string, unknown>): Promise<ComplianceEvent>;
    /**
     * Log data access event
     */
    logDataAccess(action: "view" | "export" | "delete" | "request", actor: Partial<ComplianceActor>, dataType: string, success: boolean, details?: Record<string, unknown>): Promise<ComplianceEvent>;
    /**
     * Log data export event (GDPR Article 20)
     */
    logDataExport(actor: Partial<ComplianceActor>, dataTypes: string[], success: boolean, details?: Record<string, unknown>): Promise<ComplianceEvent>;
    /**
     * Log data deletion event (GDPR Article 17)
     */
    logDataDeletion(actor: Partial<ComplianceActor>, dataType: string, itemCount: number, success: boolean, details?: Record<string, unknown>): Promise<ComplianceEvent>;
    /**
     * Log security incident
     */
    logSecurityIncident(incidentType: string, severity: "low" | "medium" | "high" | "critical", details: Record<string, unknown>): Promise<ComplianceEvent>;
    /**
     * Log policy change
     */
    logPolicyChange(setting: string, oldValue: unknown, newValue: unknown, changedBy: "user" | "system" | "admin"): Promise<ComplianceEvent>;
    /**
     * Log access control event
     */
    logAccessControl(action: "login" | "logout" | "auth_failed" | "locked_out", actor: Partial<ComplianceActor>, success: boolean, details?: Record<string, unknown>): Promise<ComplianceEvent>;
    /**
     * Log retention event
     */
    logRetention(action: "cleanup" | "archive" | "delete", dataType: string, itemCount: number, details?: Record<string, unknown>): Promise<ComplianceEvent>;
    /**
     * Log breach notification
     */
    logBreach(breachType: string, severity: "low" | "medium" | "high" | "critical", notificationSent: boolean, details: Record<string, unknown>): Promise<ComplianceEvent>;
    /**
     * Get events by category
     */
    getEvents(category?: ComplianceEventCategory, from?: Date, to?: Date, limit?: number): Promise<ComplianceEvent[]>;
    /**
     * Get log files sorted by date (newest first)
     */
    private getLogFiles;
    /**
     * Verify hash chain integrity
     */
    verifyIntegrity(): Promise<{
        valid: boolean;
        lastValidEvent?: string;
        firstInvalidEvent?: string;
        totalEvents: number;
        validEvents: number;
    }>;
    /**
     * Return the current in-memory chain head (hash of the last event this process
     * wrote, or the seeded value at startup). Diagnostic only — writeEvent always
     * re-reads the authoritative tail from disk under lock before linking (L49).
     */
    getChainHead(): string;
    /**
     * Get compliance log statistics
     */
    getStats(): Promise<{
        enabled: boolean;
        retentionYears: number;
        complianceDir: string;
        logFileCount: number;
        totalEvents: number;
        eventsByCategory: Record<ComplianceEventCategory, number>;
    }>;
}
/**
 * Get the compliance logger instance
 */
export declare function getComplianceLogger(): ComplianceLogger;
/**
 * Log a compliance event (convenience function)
 */
export declare function logComplianceEvent(category: ComplianceEventCategory, eventType: string, actor: Partial<ComplianceActor>, outcome: "success" | "failure" | "pending", options?: {
    resource?: ComplianceResource;
    details?: Record<string, unknown>;
    legalBasis?: LegalBasis;
    dataCategories?: DataCategory[];
    retentionDays?: number;
    failureReason?: string;
}): Promise<ComplianceEvent>;