/**
 * GovernanceReporter -- SDK Event Reporter (Phase 1C).
 *
 * Streams governance events to the My Compliance Center SaaS API.
 * Supports batching, WAL-based durability, heartbeats, and dry-run mode.
 *
 * Uses Node built-in fetch (Node 18+) and crypto.randomUUID().
 * No external HTTP dependencies.
 *
 * @connexum/ai-governance
 */
import type { ActionContext, ActionDecision } from '../adapters/index';
import { PluginRegistry, type PluginContext } from '../governance/plugin-system';
export interface GovernanceReporterConfig {
    /** My Compliance Center API endpoint */
    apiEndpoint: string;
    /** License key (JWT) for authentication */
    licenseKey: string;
    /** Installation ID (unique per deployment) */
    installationId: string;
    /** Organization ID */
    orgId: string;
    /** Batch size before flush (default: 50) */
    batchSize?: number;
    /** Flush interval in ms (default: 10000 = 10s) */
    flushIntervalMs?: number;
    /** Heartbeat interval in ms (default: 60000 = 60s) */
    heartbeatIntervalMs?: number;
    /** WAL directory for durability (append-only file) */
    walDir?: string;
    /** Maximum events in WAL before forced flush (default: 1000) */
    maxWalSize?: number;
    /** Disable actual HTTP calls (for testing) */
    dryRun?: boolean;
    /**
     * Optional PluginRegistry instance.
     *
     * SYSTEMIC-H4-WIRE: when provided, `renderReport()` calls
     * `executeOnReport()` to collect plugin-authored sections and prepends
     * the `banner` (incomplete-plugin warning) to the top of the rendered
     * report. Required for auditor-visible plugin failure surfacing.
     */
    pluginRegistry?: PluginRegistry;
    /**
     * P4-RET-01: Optional DataClassifier for stamping DataClassTag on every
     * WAL event at 'governance-reporter:wal:event'. When provided, reportEvent()
     * classifies each event before writing it to the WAL. Fail-closed: if
     * classification throws, the event is refused.
     *
     * TODO(P4-RET-04 migration): make this required once the Prisma
     * GovernanceEvent model gains packBinding/dataClass columns.
     */
    dataClassifier?: import('../retention/classifier').DataClassifier;
    /** Tenant ID for DataClassifier context. Required when dataClassifier is set. */
    tenantId?: string;
    /** Contract ID for DataClassifier context. Required when dataClassifier is set. */
    contractId?: string;
    /** Active pack IDs for the tenant. Required when dataClassifier is set. */
    activePackIds?: string[];
}
export interface ReporterEvent {
    id: string;
    type: 'governance_decision' | 'heartbeat' | 'agent_status' | 'compliance_score';
    timestamp: string;
    installationId: string;
    orgId: string;
    payload: Record<string, unknown>;
    /**
     * P4-RET-01: Data classification tag stamped at ingestion time.
     * Embedded in the JSONL WAL record so every event carries its pack binding.
     *
     * TODO(P4-RET-04 migration): when the Prisma GovernanceEvent model gains
     * packBinding/dataClass columns, persist via DB columns instead.
     * Prisma model diff (add to schema.prisma when P4-RET-04 lands):
     *   dataClass    String?
     *   packBinding  String[]
     *   sovereigntyZone String?
     *   classifiedAt DateTime?
     */
    dataClassTag?: import('../retention/data-class').DataClassTag;
}
export interface FlushResult {
    sent: number;
    failed: number;
    walPending: number;
}
/**
 * The output of `GovernanceReporter.renderReport()`.
 *
 * SYSTEMIC-H4-WIRE: plugin sections are collected via
 * `PluginRegistry.executeOnReport()` and appended to `sections`. The
 * `banner` field (when non-null) MUST be rendered at the TOP of any
 * document produced from this report -- not buried in a footnote --
 * so auditors see incomplete-plugin warnings immediately.
 */
export interface RenderedReport {
    /**
     * Top-of-document banner. Non-null when one or more plugins failed
     * during report generation. Auditors must see this first.
     */
    banner: string | null;
    /** ISO timestamp of report generation */
    generatedAt: string;
    /** Installation and org identifiers */
    installationId: string;
    orgId: string;
    /** Per-plugin status summary */
    pluginStatuses: Array<{
        pluginId: string;
        status: 'ok' | 'error';
        errorMessage?: string;
    }>;
    /** Number of plugins that failed during this report cycle */
    incompletePluginCount: number;
    /** Names of plugins that failed during this report cycle */
    incompletePlugins: string[];
    /** Plugin-authored report sections. Failed plugins appear as `{ status: 'error' }`. */
    sections: Record<string, unknown>[];
    /** Caller-supplied report context metadata */
    context: Record<string, unknown>;
}
export declare class GovernanceReporter {
    private readonly config;
    private readonly batchSize;
    private readonly flushIntervalMs;
    private readonly heartbeatIntervalMs;
    private readonly maxWalSize;
    private readonly walPath;
    private readonly dryRun;
    private queue;
    private flushTimer;
    private heartbeatTimer;
    private malformedWalCount;
    private readonly pluginRegistry;
    constructor(config: GovernanceReporterConfig);
    /**
     * Add an event to the queue.
     * Triggers auto-flush when queue reaches batchSize.
     */
    reportEvent(event: ReporterEvent): void;
    /**
     * Convenience: create a governance_decision event from adapter types.
     */
    reportDecision(context: ActionContext, decision: ActionDecision): void;
    /**
     * Flush queued events to the API.
     * On success, clears the WAL. On failure, events remain for retry.
     */
    flush(): Promise<FlushResult>;
    /**
     * Send a heartbeat to the API.
     */
    sendHeartbeat(): Promise<void>;
    /**
     * Graceful shutdown: clear timers and flush remaining events.
     */
    shutdown(): Promise<FlushResult>;
    /**
     * Render a governance report, including plugin-authored sections.
     *
     * SYSTEMIC-H4-WIRE: this is the authoritative report-render entry point.
     * It calls `PluginRegistry.executeOnReport()` (when a registry is wired)
     * to collect plugin sections, then calls
     * `PluginRegistry.summarizeReportPluginStatuses()` to build the banner
     * and incomplete-plugin metadata.
     *
     * IMPORTANT: callers that produce a human-readable or machine-readable
     * document from this output MUST render `banner` at the TOP of the
     * document before any other content. A non-null banner signals that the
     * report is incomplete and auditors must not treat it as definitive.
     *
     * @param context Caller-supplied context forwarded to plugin hooks.
     *   Include session identifiers, agent names, and policy pack IDs.
     * @param reportContext Additional metadata to embed in the report.
     * @returns RenderedReport with banner, plugin sections, and status summary.
     */
    renderReport(context: PluginContext, reportContext?: Record<string, unknown>): RenderedReport;
    /**
     * Current number of events waiting in the queue.
     */
    getQueueDepth(): number;
    /**
     * SYSTEMIC-L1: Number of malformed WAL entries encountered since startup.
     * A non-zero value is a tampering signal and should trigger investigation.
     * Exposed for operator tooling and test assertion.
     */
    getMalformedWalCount(): number;
    /**
     * Number of entries in the WAL file. Returns 0 if WAL is not configured.
     */
    getWalSize(): number;
    private loadWal;
    private appendToWal;
    private truncateWal;
}
//# sourceMappingURL=governance-reporter.d.ts.map