/**
 * AccessReview -- Quarterly access review for compliance frameworks.
 *
 * SOC 2, HIPAA, and ISO 27001 require periodic review of access rights.
 * This module automates the review process:
 *   - Generates access review reports
 *   - Flags inactive operators for deactivation
 *   - Tracks review completion status
 *   - Maintains review audit trail
 *
 * T-060: Quarterly access review automation.
 *
 * @connexum/ai-governance
 */
export interface AccessReviewConfig {
    /** Directory for review data */
    reviewDir: string;
    /** Review frequency in ms (default: 90 days / quarterly) */
    reviewFrequencyMs?: number;
    /** Days of inactivity before flagging (default: 30) */
    inactivityThresholdDays?: number;
    /** Organization name for reports */
    organizationName?: string;
}
export interface ReviewCycle {
    id: string;
    startedAt: string;
    deadline: string;
    completedAt?: string;
    status: 'IN_PROGRESS' | 'COMPLETED' | 'OVERDUE';
    entries: ReviewEntry[];
    summary?: ReviewSummary;
}
export interface ReviewEntry {
    operatorId: string;
    operatorName: string;
    role: string;
    active: boolean;
    lastActivity?: string;
    flags: ReviewFlag[];
    decision: 'RETAIN' | 'MODIFY' | 'REVOKE' | 'PENDING';
    reviewedBy?: string;
    reviewedAt?: string;
    notes?: string;
}
export type ReviewFlag = 'INACTIVE' | 'ELEVATED_PRIVILEGES' | 'NO_RECENT_LOGIN' | 'ROLE_MISMATCH' | 'NEW_OPERATOR';
export interface ReviewSummary {
    totalOperators: number;
    retained: number;
    modified: number;
    revoked: number;
    pending: number;
    flaggedInactive: number;
    completionRate: number;
}
export interface OperatorInfo {
    id: string;
    name: string;
    role: string;
    active: boolean;
    lastActivity?: string;
    createdAt?: string;
}
export declare class AccessReview {
    private config;
    private cyclesFile;
    private auditFile;
    constructor(config: AccessReviewConfig);
    /**
     * Start a new review cycle.
     */
    startReview(operators: OperatorInfo[]): ReviewCycle;
    /**
     * Record a review decision for an operator.
     */
    recordDecision(cycleId: string, operatorId: string, decision: 'RETAIN' | 'MODIFY' | 'REVOKE', reviewedBy: string, notes?: string): void;
    /**
     * Complete a review cycle (all decisions must be recorded).
     */
    completeReview(cycleId: string): ReviewSummary;
    /**
     * Check if a review is due based on the last completed review.
     *
     * SYSTEMIC-M2 contract (2026-04-22): the return direction is
     * "review IS due" -- callers must treat `true` as "access must be
     * re-attested NOW" and `false` as "review not yet due, no action
     * needed." Any caller that interprets `true` as "no review needed"
     * has the direction inverted and must be fixed immediately.
     *
     * @returns {boolean} true = review is due (access must be re-attested);
     *                    false = review not yet due, no action needed.
     */
    isReviewDue(): boolean;
    /**
     * Get the current (most recent) review cycle.
     */
    getCurrentCycle(): ReviewCycle | undefined;
    /**
     * Get all review cycles.
     */
    getAllCycles(): ReviewCycle[];
    /**
     * Get overdue review cycles.
     */
    getOverdue(): ReviewCycle[];
    /**
     * Get review statistics across all cycles.
     */
    getStats(): {
        totalCycles: number;
        completedCycles: number;
        overdueCycles: number;
        isReviewDue: boolean;
        lastCompletedAt?: string;
    };
    private createEntry;
    private computeSummary;
    private loadCycles;
    private saveCycles;
    private audit;
}
//# sourceMappingURL=access-review.d.ts.map