/**
 * IncidentNotifier -- Compliance-driven incident notification system.
 *
 * Manages incident classification, deadline tracking, and notification
 * delivery for regulatory compliance.
 *
 * Regulatory deadlines:
 *   - DORA: 4 hours for major ICT incidents (Art. 19)
 *   - GDPR: 72 hours for personal data breaches (Art. 33)
 *   - HIPAA: 60 days for breach notification (45 CFR 164.404)
 *   - PCI DSS: Immediate for suspected compromise
 *   - SOC 2: Per customer SLA (typically 24-72 hours)
 *
 * @connexum/ai-governance
 */
/**
 * HL-1: Thrown when the incident notifier finds zero packs loaded and
 * therefore cannot derive a compliant fallback category list.
 *
 * Failing closed here is intentional: an incident notifier with no pack
 * context should not silently downgrade severity by guessing categories.
 * The operator must ensure packs are loaded before incidents are classified.
 *
 * Reference: W1 directive (Thomas, 2026-04-24): runtime must read from packs,
 * not from hardcoded lists.
 */
export declare class NoPacksLoadedError extends Error {
    constructor();
}
export type IncidentSeverity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
export type IncidentStatus = 'open' | 'investigating' | 'contained' | 'resolved' | 'closed';
export interface IncidentNotifierConfig {
    /** Directory for incident records */
    incidentDir: string;
    /** Webhook URLs for notifications (keyed by severity) */
    webhooks?: Record<IncidentSeverity, string[]>;
    /** Active compliance frameworks (for deadline calculation) */
    activeFrameworks?: string[];
    /** Default notification email (for logging, not sending) */
    notificationEmail?: string;
    /**
     * F-NEW-MED-15 (2026-05-02): pack-declared deadlines.
     * When provided, every framework lookup first consults this map (built
     * by the caller from packs[] -> incidentPolicy.notificationDeadlineHours).
     * Falls back to the legacy hardcoded map if the framework is absent.
     *
     * Pre-fix: only 6 frameworks (HIPAA/DORA/GDPR/PCI DSS/SOC 2/FERPA) had
     * wired deadlines. The other 93 packs' declared deadlines were dead
     * data on this code path. This config closes that gap by pushing the
     * source-of-truth back to pack metadata.
     */
    packDeadlinesByFramework?: Record<string, number>;
}
export interface Incident {
    /** Unique incident ID */
    id: string;
    /** Short title */
    title: string;
    /** Detailed description */
    description: string;
    /** Severity classification */
    severity: IncidentSeverity;
    /** Current status */
    status: IncidentStatus;
    /** What type of data was affected */
    dataTypes: string[];
    /** Estimated number of records affected */
    recordsAffected: number;
    /** Which agents were involved */
    affectedAgents: string[];
    /** Attack vector or cause */
    cause: string;
    /** When discovered */
    discoveredAt: string;
    /** When created in the system */
    createdAt: string;
    /** Regulatory deadlines (framework -> absolute deadline ISO string) */
    deadlines: Record<string, string>;
    /** Notification history */
    notifications: IncidentNotification[];
    /** Status change history */
    timeline: IncidentTimelineEntry[];
}
export interface IncidentNotification {
    timestamp: string;
    channel: string;
    recipient: string;
    status: 'sent' | 'failed' | 'pending';
    message?: string;
}
export interface IncidentTimelineEntry {
    timestamp: string;
    action: string;
    actor: string;
    detail?: string;
}
export interface IncidentClassification {
    severity: IncidentSeverity;
    reasons: string[];
    deadlines: Record<string, {
        framework: string;
        hoursFromDiscovery: number;
        deadline: string;
    }>;
    requiresImmediateAction: boolean;
    /**
     * W1 residual (2026-04-24): human-readable severity label set derived from
     * the industries declared by the compliance packs that matched the blocking
     * categories. These are computed by deriveSeverityLabels() and are NEVER
     * sourced from hardcoded category strings in this file.
     *
     * Examples: 'HEALTHCARE', 'PRIVACY', 'FINANCIAL', 'EDUCATION', 'GOVERNMENT', 'LEGAL'.
     */
    severityLabels: string[];
}
/**
 * Derive a set of human-readable severity labels from the pack IDs that
 * produced blocking-category matches on an incident.
 *
 * Each matched pack contributes its declared industries[] to the label
 * derivation. The result is the union of all labels that any matched pack's
 * industries trigger via INDUSTRY_LABEL_RULES.
 *
 * W1 directive: no category name strings (PHI, PII, GDPR, ...) appear in
 * this function. The pack's own metadata drives the output.
 *
 * @param matchedPackIds - Pack IDs whose categories matched (BLOCK or above).
 * @param getIndustries  - Lookup function: packId -> industries[]. Supplied
 *                         by the caller from PackDrivenClassifier.getPackIndustries().
 */
export declare function deriveSeverityLabels(matchedPackIds: Iterable<string>, getIndustries: (packId: string) => string[]): Set<string>;
export declare class IncidentNotifier {
    private config;
    private incidents;
    private incidentFile;
    constructor(config: IncidentNotifierConfig);
    /**
     * Classify an incident based on data types, volume, and cause.
     */
    classify(params: {
        dataTypes: string[];
        recordsAffected: number;
        cause: string;
        affectedAgents: string[];
    }): IncidentClassification;
    /**
     * Create a new incident.
     */
    create(params: {
        title: string;
        description: string;
        dataTypes: string[];
        recordsAffected: number;
        cause: string;
        affectedAgents: string[];
        discoveredAt?: string;
    }): Incident;
    /**
     * Update incident status.
     */
    updateStatus(incidentId: string, status: IncidentStatus, actor: string, detail?: string): Incident;
    /**
     * Get an incident by ID.
     */
    get(incidentId: string): Incident | null;
    /**
     * Get all open incidents.
     */
    getOpen(): Incident[];
    /**
     * Get incidents with approaching or breached deadlines.
     */
    getUrgent(withinHours?: number): Incident[];
    /**
     * Check if any deadlines have been breached.
     */
    getBreachedDeadlines(): Array<{
        incident: Incident;
        framework: string;
        deadline: string;
    }>;
    /**
     * Get incident statistics.
     */
    getStats(): {
        total: number;
        open: number;
        bySeverity: Record<IncidentSeverity, number>;
        breachedDeadlines: number;
    };
    private logNotification;
    private saveIncidents;
    private loadIncidents;
}
//# sourceMappingURL=incident-notifier.d.ts.map