/**
 * DestinationHealthMonitor -- per-adapter health tracking for all audit destinations.
 *
 * Tracks delivery lifecycle (attempt, success, retry, failure, DLQ write) for
 * every registered audit destination adapter: Splunk HEC, Syslog RFC 5424, and
 * the forthcoming custom-webhook, Datadog, Sentinel, and Sumo Logic destinations.
 *
 * Storage abstraction: v1 ships InMemoryHealthMetricsStore only. A future PR
 * will wire RedisHealthMetricsStore / PrismaHealthMetricsStore for production
 * persistence. See docs/observability/destination-health-monitor.md.
 *
 * Pack-binding primacy: every recordAttempt() call MUST carry a non-empty
 * packBinding[]. Empty binding throws UnboundDataError (Thomas Directive, 2026-04-22).
 *
 * Secret sanitization: this module applies a defense-in-depth sanitization pass
 * on all error strings via sanitizeErrorString(). Adapters are still responsible
 * for primary sanitization before calling recordFailure(). See PT-HEALTH-2.
 *
 * @connexum/ai-governance
 */
import { type HealthMetricsStore, type DestinationHealthSummary } from './health-metrics-store';
/**
 * Redact common secret patterns from an error string.
 *
 * This is a defense-in-depth measure. Adapters bear primary responsibility
 * for sanitizing error strings before passing them to the monitor. This
 * function provides a second layer in case a pattern slips through.
 *
 * Matched substrings are replaced with `[REDACTED]`.
 *
 * @param input - Raw error string, possibly containing sensitive data
 * @returns Sanitized string safe for storage and logging
 */
export declare function sanitizeErrorString(input: string): string;
export type TerminalFailureReason = '4xx' | 'exhausted' | 'config-error' | 'binding-error';
export type RetryReason = '429' | '5xx' | 'network';
export interface DestinationHealthMonitorConfig {
    /**
     * Storage backend for health records.
     * Defaults to InMemoryHealthMetricsStore when not provided.
     *
     * Limitation (v1): in-memory data is lost on process restart.
     * Provide a persistent store (Redis, Prisma) for production durability.
     */
    store?: HealthMetricsStore;
}
/**
 * Central health monitor for all audit destination adapters.
 *
 * Usage:
 *   const monitor = new DestinationHealthMonitor();
 *   monitor.register('splunk-prod');
 *
 *   // Inside the adapter, pre-network:
 *   monitor.recordAttempt('splunk-prod', event.packBinding);
 *
 *   // Post-200:
 *   monitor.recordSuccess('splunk-prod', latencyMs);
 *
 *   // On transient retry:
 *   monitor.recordRetry('splunk-prod', '5xx', latencyMs);
 *
 *   // On terminal failure:
 *   monitor.recordFailure('splunk-prod', 'exhausted', sanitizedErr);
 *
 *   // After DLQ append:
 *   monitor.recordDlqWrite('splunk-prod');
 *
 *   // Query:
 *   const summary = monitor.getHealth('splunk-prod');
 *   const all = monitor.getHealthSummary();
 *
 * Wire-in to existing destinations is a follow-up PR (see PR body). This PR
 * ships the monitor itself; destination modifications stay out of scope.
 */
export declare class DestinationHealthMonitor {
    private readonly store;
    constructor(config?: DestinationHealthMonitorConfig);
    /**
     * Register an adapter with the monitor. Must be called once per adapter
     * before any lifecycle hooks are invoked. Safe to call multiple times
     * (subsequent calls for the same id are no-ops).
     */
    register(adapterId: string): void;
    /**
     * Record a delivery attempt (call pre-network).
     *
     * @throws UnboundDataError when packBinding is empty (PT-HEALTH-1).
     */
    recordAttempt(adapterId: string, packBinding: string[]): void;
    /**
     * Record a successful delivery (call post-200).
     *
     * @param latencyMs - Round-trip time in milliseconds for this delivery.
     */
    recordSuccess(adapterId: string, latencyMs: number): void;
    /**
     * Record a transient retry (call per retry before the next attempt).
     *
     * @param reason - HTTP category or network error type.
     * @param latencyMs - Time elapsed for the failed attempt in milliseconds.
     */
    recordRetry(adapterId: string, reason: RetryReason, latencyMs: number): void;
    /**
     * Record a terminal failure (call when the event is DLQ-bound or dropped).
     *
     * The sanitizedError string is passed through sanitizeErrorString() as a
     * second-pass defense before storage. Adapters must still sanitize first.
     *
     * @param terminalReason - Categorized failure type.
     * @param sanitizedError - Pre-sanitized error description. MUST NOT contain
     *   secrets, endpoint URLs with embedded keys, or HMAC signatures.
     */
    recordFailure(adapterId: string, terminalReason: TerminalFailureReason, sanitizedError: string): void;
    /**
     * Record a DLQ write (call after appending to the dead-letter queue file).
     * Increments dlqDepth; depth is NOT automatically decremented on drain --
     * call resetDlqDepth() after a successful drain cycle.
     */
    recordDlqWrite(adapterId: string): void;
    /**
     * Reset DLQ depth counter after a successful drain cycle.
     * Does not reset other counters.
     */
    resetDlqDepth(adapterId: string): void;
    /**
     * Update the circuit-breaker state for an adapter.
     * Call this whenever the adapter's circuit-breaker state transitions.
     * Pass null if the adapter does not have a circuit breaker.
     */
    setCircuitBreakerState(adapterId: string, state: 'open' | 'half-open' | 'closed' | null): void;
    /**
     * Return a health summary for a single adapter, or null if not registered.
     */
    getHealth(adapterId: string): DestinationHealthSummary | null;
    /**
     * Return health summaries for all registered adapters.
     */
    getHealthSummary(): DestinationHealthSummary[];
    /**
     * Auto-register an adapter if not yet registered.
     * This is a convenience for adapters that call lifecycle hooks before
     * explicitly calling register(). Explicit register() is still preferred.
     */
    private ensureRegistered;
}
//# sourceMappingURL=destination-health-monitor.d.ts.map