/**
 * SentinelRetentionAdapter -- P4-RET-04 Azure Sentinel retention (AC 14)
 *
 * Wired 2026-05-02 per Thomas Layer 0 directive (F-NEW-CRIT-31).
 *
 * Configuration:
 *   - AZURE_TENANT_ID: Azure AD tenant ID
 *   - AZURE_CLIENT_ID: App registration client ID with Log Analytics Contributor
 *   - AZURE_CLIENT_SECRET: Client secret
 *   - AZURE_SUBSCRIPTION_ID: Azure subscription containing the workspaces
 *   - SENTINEL_WORKSPACE_MAP: JSON blob mapping tenantId ->
 *       { resourceGroupName, workspaceName }
 *   - opts.armBaseUrl / opts.oauthBaseUrl (test overrides)
 *
 * Behavior:
 *   1. Acquire OAuth2 token via client_credentials flow against
 *      login.microsoftonline.com/<tenantId>/oauth2/v2.0/token
 *   2. PATCH workspace at management.azure.com/.../workspaces/<ws>?api-version=2022-10-01
 *      { properties: { retentionInDays: <days> } }
 *   - 10s default timeout per call, 1 retry on 5xx or network error.
 *   - Token cached in-process for ~50 minutes (default Azure lifetime is 60 min).
 *   - On final failure, dispatches to DLQ callback (if injected) and rethrows.
 *
 * Spec: P4-RET-01 Section 2.4, AC 14
 *
 * @connexum/ai-governance
 */
import type { LogAggregatorRetention } from './log-aggregator.js';
import type { RetentionDLQCallback } from './splunk.js';
interface WorkspaceRef {
    resourceGroupName: string;
    workspaceName: string;
}
export interface SentinelRetentionAdapterOpts {
    tenantId?: string;
    clientId?: string;
    clientSecret?: string;
    subscriptionId?: string;
    workspaceMap?: Record<string, WorkspaceRef>;
    /** Test override: ARM base URL. Defaults to https://management.azure.com */
    armBaseUrl?: string;
    /** Test override: OAuth base URL. Defaults to https://login.microsoftonline.com */
    oauthBaseUrl?: string;
    timeoutMs?: number;
    dlq?: RetentionDLQCallback;
    fetchImpl?: typeof fetch;
}
export declare class SentinelRetentionAdapter implements LogAggregatorRetention {
    readonly aggregatorType = "sentinel";
    private readonly tenantId;
    private readonly clientId;
    private readonly clientSecret;
    private readonly subscriptionId;
    private readonly workspaceMap;
    private readonly armBaseUrl;
    private readonly oauthBaseUrl;
    private readonly timeoutMs;
    private readonly dlq;
    private readonly fetchImpl;
    private cachedToken;
    constructor(opts?: SentinelRetentionAdapterOpts);
    setTenantRetention(tenantId: string, days: number): Promise<void>;
    getTenantRetention(tenantId: string): Promise<number | null>;
    /**
     * Fetch a bearer token from Azure AD via client_credentials grant.
     * Caches the token for TOKEN_TTL_MS.
     * Exposed as protected so subclasses / tests can override if needed.
     */
    private getAccessToken;
    private doFetch;
    private dispatchWithRetry;
    private isRetryable;
}
export {};
//# sourceMappingURL=sentinel.d.ts.map