/**
 * RetentionEnforcementLogStore -- F-NEW-RETENTION-ENFORCEMENT-TRACKER
 *
 * Persists per-store enforcement run history so the
 * GET /api/v1/retention/store-enforcement/:tenantId endpoint can return
 * real timestamps instead of null, upgrading dataMode from
 * 'policy-matrix-only' to 'full'.
 *
 * Architecture note:
 *   DbRetentionSweep runs globally (not per-tenant) and sweeps tables by
 *   retentionAt. AggregatorReconciler runs per-tenant. RetentionManager
 *   is write-time.
 *
 *   For the 'db' store we record one log entry per DbRetentionSweep.runOnce()
 *   invocation, aggregating across all tenants in that run. The storeName is
 *   always 'db' for these entries, and tenantId is set to the special sentinel
 *   GLOBAL_DB_SWEEP_TENANT to indicate a global (multi-tenant) sweep.
 *
 *   For log-aggregator stores (splunk, datadog, sentinel) the AggregatorReconciler
 *   calls recordRun() per-tenant after each reconcileTenant() call. storeName
 *   is 'splunk' | 'datadog' | 'sentinel'.
 *
 *   The endpoint for tenantId=X reads rows for that tenant OR the global sweep
 *   sentinel so it can surface db sweep history even before per-tenant tracking
 *   is wired.
 *
 * In-memory implementation is the default (sidecar mode, tests). The
 * InMemoryEnforcementLogStore is used when no DATABASE_URL is configured.
 * A PostgreSQL-backed implementation wrapping PrismaClient can be substituted
 * by passing an adapter to the store-enforcement endpoint.
 *
 * @connexum/ai-governance
 */
export declare const GLOBAL_DB_SWEEP_TENANT = "__global_db_sweep__";
export type EnforcementRunStatus = 'running' | 'completed' | 'failed' | 'cancelled';
export type StoreName = 'audit-chain' | 'db' | 's3' | 'splunk' | 'datadog' | 'sentinel';
export interface EnforcementLogEntry {
    id: string;
    tenantId: string;
    storeName: StoreName;
    startedAt: Date;
    completedAt: Date | null;
    status: EnforcementRunStatus;
    recordsScanned: number;
    recordsPurged: number;
    failureReason: string | null;
}
export interface RecordRunInput {
    tenantId: string;
    storeName: StoreName;
    startedAt: Date;
    completedAt: Date;
    status: EnforcementRunStatus;
    recordsScanned: number;
    recordsPurged: number;
    failureReason?: string;
}
/**
 * Backing store for retention enforcement run history.
 *
 * Two implementations:
 *   - InMemoryEnforcementLogStore (default, tests, sidecar)
 *   - PrismaEnforcementLogStore (PostgreSQL, production)
 */
export interface EnforcementLogStore {
    /**
     * Record a completed (or failed) enforcement run.
     * Returns the persisted entry.
     */
    recordRun(input: RecordRunInput): Promise<EnforcementLogEntry>;
    /**
     * Return the most recent completed run per store for the given tenant.
     *
     * The query also includes GLOBAL_DB_SWEEP_TENANT rows for the 'db' store
     * so per-tenant callers see global sweep timestamps.
     *
     * Returns a Map<storeName, EnforcementLogEntry> for all stores that have
     * at least one completed run.
     */
    latestCompletedRunsPerStore(tenantId: string): Promise<Map<StoreName, EnforcementLogEntry>>;
    /**
     * Return true if any completed run exists for the given tenant (or global sentinel).
     * Used to decide dataMode.
     */
    hasAnyCompletedRun(tenantId: string): Promise<boolean>;
    /**
     * Return failed runs for the given tenant (or global sentinel) started within
     * the last `sinceHours` hours, ordered most-recent first. Closes CR-MED-05:
     * pre-fix the audit log captured failures but no caller surfaced them, so
     * silent retention-deletion failures had no operator-visible signal.
     *
     * sinceHours defaults to 168 (7 days) at the call site if not provided.
     */
    recentFailedRuns(tenantId: string, sinceHours: number): Promise<EnforcementLogEntry[]>;
}
export declare class InMemoryEnforcementLogStore implements EnforcementLogStore {
    private readonly entries;
    recordRun(input: RecordRunInput): Promise<EnforcementLogEntry>;
    latestCompletedRunsPerStore(tenantId: string): Promise<Map<StoreName, EnforcementLogEntry>>;
    hasAnyCompletedRun(tenantId: string): Promise<boolean>;
    recentFailedRuns(tenantId: string, sinceHours: number): Promise<EnforcementLogEntry[]>;
    /** Test helper: return all stored entries. */
    allEntries(): readonly EnforcementLogEntry[];
    /** Test helper: clear all stored entries. */
    clear(): void;
}
/**
 * Wraps an enforcement run function, records start + completion/failure to
 * the log store, and re-throws on failure (so the caller's error path is
 * preserved).
 *
 * @param logStore   The EnforcementLogStore to record to.
 * @param tenantId   Tenant this run belongs to (use GLOBAL_DB_SWEEP_TENANT for global sweeps).
 * @param storeName  Which store this run operates on.
 * @param runFn      The actual enforcement function. Must return { recordsScanned, recordsPurged }.
 */
export declare function trackEnforcementRun<T extends {
    recordsScanned: number;
    recordsPurged: number;
}>(logStore: EnforcementLogStore, tenantId: string, storeName: StoreName, runFn: () => Promise<T>): Promise<T>;
//# sourceMappingURL=enforcement-log-store.d.ts.map