/**
 * SumoLogicHttpDestination -- Sumo Logic HTTP Source output adapter.
 *
 * Delivers governance events to a Sumo Logic HTTP Source endpoint using
 * newline-delimited JSON (NDJSON). Mirrors the structural pattern of
 * SplunkHecDestination, DatadogLogsDestination, and SentinelDestination.
 *
 * Design decisions:
 *   - No Sumo Logic SDK. Plain HTTPS POST via Node built-ins (no supply-chain risk).
 *   - The endpoint URL is itself the secret: it contains an embedded token.
 *     The full URL is NEVER stored after construction validation; only the resolver
 *     reference is held. The resolved URL is used only in the HTTPS request and
 *     is NEVER logged, emitted to errors, or written to DLQ entries (PT-SUMO-1).
 *   - Retry semantics mirror sentinel.ts and splunk-hec.ts:
 *     429 (rate-limited) + 5xx = retryable. Retry-After honored on 429.
 *     4xx other than 429 = non-retryable; DLQ immediately.
 *   - Gzip compression (built-in zlib) applied by default. Configurable.
 *     Recommended for batches > a few KB per Sumo Logic documentation.
 *   - packBinding is mandatory. Empty binding throws UnboundDataError before any
 *     HTTP request (pack-binding primacy, Thomas Directive 2026-04-22).
 *   - Endpoint URL (including embedded token) is NEVER emitted to any log stream,
 *     error message, or DLQ entry. Sanitised to domain-only fingerprint (PT-SUMO-1).
 *   - Body chunking by serialised byte size: max 1 MB per request (hard Sumo limit).
 *     Events too large to fit alone are individually DLQ'd -- no silent truncation.
 *   - Optional X-Sumo-* override headers: Name, Category, Host, Fields.
 *
 * Sumo Logic HTTP Source wire format:
 *   POST https://endpoint<N>.collection.<region>.sumologic.com/receiver/v1/http/<token>
 *   Content-Type: application/x-ndjson
 *   Content-Encoding: gzip  (when compression enabled)
 *   X-Sumo-Name: <sourceName>  (optional)
 *   X-Sumo-Category: <category>  (optional)
 *   X-Sumo-Host: <host>  (optional)
 *   X-Sumo-Fields: key1=val1,key2=val2  (optional)
 *   Body: <json-line1>\n<json-line2>\n...
 *
 * Returns 200 on accept, 4xx on validation error, 429 on rate limit, 5xx on transient.
 *
 * @connexum/ai-governance
 */
import type { EventPayload } from '../event-bus';
/**
 * Resolves a secret reference to the actual plaintext value.
 * For Sumo Logic the "secret" is the full HTTP Source endpoint URL
 * (which contains an embedded token). The resolved URL is used only
 * in-flight and is NEVER cached on the instance or logged.
 */
export type SecretResolver = (ref: string) => Promise<string>;
export interface SumoLogicConfig {
    /** Discriminator for discriminated-union destination config registries. */
    kind: 'sumo-logic-http';
    /**
     * KMS/secret-manager reference that resolves to the full Sumo Logic
     * HTTP Source endpoint URL (which embeds the collection token).
     *
     * Example reference: "arn:aws:secretsmanager:us-east-1:123:secret/sumo-http-url"
     * Example resolved value:
     *   "https://endpoint1.collection.us2.sumologic.com/receiver/v1/http/<token>"
     *
     * The resolved URL is NEVER stored in instance state, logged, or written
     * to DLQ entries (PT-SUMO-1).
     */
    endpointUrlRef: string;
    /**
     * Optional Sumo Logic source name override.
     * Sent as the X-Sumo-Name header when provided.
     */
    sourceName?: string;
    /**
     * Optional Sumo Logic source category override.
     * Sent as the X-Sumo-Category header when provided.
     */
    sourceCategory?: string;
    /**
     * Optional Sumo Logic host override.
     * Sent as the X-Sumo-Host header when provided.
     * Defaults to process.env.HOSTNAME when not provided (no header sent if absent).
     */
    sourceHost?: string;
    /**
     * Optional metadata fields as a comma-separated key=value string.
     * Sent as the X-Sumo-Fields header when provided.
     * Example: "env=prod,team=governance,region=us-east-1"
     */
    sourceFields?: string;
    /**
     * Enable gzip compression. Default: true.
     * Recommended for batches over a few KB.
     */
    compress?: boolean;
    /**
     * Maximum serialised body size (pre-compression) per request in bytes.
     * Sumo Logic hard limit is 1 MB compressed. We use the uncompressed
     * serialised size as the chunking threshold for deterministic splitting.
     * Default: 950_000 (leaves margin below 1 MB).
     */
    maxBatchBytes?: number;
    /**
     * Compliance pack IDs governing this destination.
     * MANDATORY -- empty array throws UnboundDataError at construction.
     * Invariant: Thomas Directive 2026-04-22 (pack-binding primacy).
     */
    packBinding: string[];
    /**
     * Directory for dead-letter queue files.
     * Created automatically if it does not exist.
     */
    dlqDir: string;
    /**
     * Allow HTTP (non-TLS) endpoint URLs.
     * Default: false. Set true ONLY in test environments.
     * Sumo Logic production endpoints are always HTTPS.
     */
    allowInsecure?: boolean;
    /** Request timeout in ms. Default: 10_000. */
    timeoutMs?: number;
    /** Maximum retry attempts on retryable errors. Default: 3. */
    maxRetries?: number;
    /** Base retry delay in ms. Doubles each attempt with +25% jitter. Default: 1_000. */
    retryDelayMs?: number;
}
export interface DeliveryResult {
    success: boolean;
    eventCount: number;
    statusCode?: number;
    attempts: number;
    error?: string;
    deliveredAt?: string;
    /** true = caller may retry later; false = permanent failure. */
    retryable?: boolean;
}
export interface DeadLetterEntry {
    events: EventPayload[];
    error: string;
    attempts: number;
    failedAt: string;
    retryable: boolean;
}
/**
 * Serialise a batch of EventPayload objects to NDJSON format.
 * Each event is JSON.stringify'd and separated by a newline.
 * Single-event batches produce one line (no trailing newline required
 * but Sumo Logic accepts both).
 */
export declare function serializeToNdjson(events: EventPayload[]): string;
/**
 * Chunk events into batches where each batch's NDJSON serialisation
 * fits within maxBytesPerBatch. Events whose individual serialisation
 * exceeds the limit are returned in the `oversized` array.
 *
 * Byte accounting uses the raw UTF-8 byte length of each serialised
 * line plus one byte for the newline separator between lines.
 */
export declare function chunkEventsByBytes(events: EventPayload[], maxBytesPerBatch: number): {
    chunks: EventPayload[][];
    oversized: EventPayload[];
};
/**
 * Compute exponential backoff with 25% jitter.
 *   delay = base * 2^(attempt-1) + random(0, base * 0.25)
 */
export declare function exponentialDelay(attempt: number, baseMs: number): number;
/**
 * Parse the Retry-After header value.
 * Accepts: integer seconds ("30") or HTTP-date.
 * Returns milliseconds to wait, or undefined if unparseable.
 */
export declare function parseRetryAfter(headerValue: string | undefined): number | undefined;
/**
 * Validate the endpoint URL at construction time.
 * Throws a descriptive error for malformed or non-HTTPS URLs (PT-SUMO-2).
 */
export declare function validateEndpointUrl(url: string, allowInsecure: boolean, label: string): void;
/**
 * Sanitise an endpoint URL for safe use in logs and error messages.
 * Returns only the scheme + host (strips the embedded token path).
 * NEVER returns the full URL which contains the secret token (PT-SUMO-1).
 */
export declare function sanitizeEndpointUrl(rawUrl: string): string;
export declare class SumoLogicHttpDestination {
    private readonly cfg;
    private readonly resolver;
    private readonly dlqFile;
    constructor(config: SumoLogicConfig, resolver: SecretResolver);
    /**
     * Deliver an array of governance events to Sumo Logic.
     *
     * Events are chunked by serialised byte size to stay under the 1 MB limit.
     * Each chunk is posted in sequence. Oversized individual events are DLQ'd.
     * Returns an aggregated DeliveryResult.
     */
    deliver(events: EventPayload[]): Promise<DeliveryResult>;
    /**
     * Flush alias for API compatibility with Splunk/Datadog/Sentinel adapters.
     * SumoLogicHttpDestination is not buffered -- deliver() sends immediately.
     * Calling flush() is a no-op that returns a success result.
     */
    flush(): Promise<DeliveryResult>;
    /**
     * Close alias for API compatibility.
     * No persistent connections to tear down.
     */
    close(): Promise<void>;
    /** Retrieve dead-letter queue entries (most recent `limit` entries). */
    getDLQ(limit?: number): DeadLetterEntry[];
    /**
     * POST a single chunk to Sumo Logic with retry + DLQ semantics.
     *
     * Security: the endpointUrl parameter is passed in per-call and NEVER
     * stored on the instance. It is used only inside this method and httpPost().
     * Any logging uses sanitizeEndpointUrl() which strips the embedded token.
     */
    private postChunk;
    /**
     * Execute the HTTPS POST to the Sumo Logic HTTP Source endpoint.
     *
     * Security contract (PT-SUMO-1):
     *   - endpointUrl is accepted as a parameter and used only inside this method.
     *   - It is NEVER stored on the instance.
     *   - It is NEVER written to any log. Only sanitizeEndpointUrl() output may be logged.
     *   - If it surfaces in a Node.js error message (e.g. ECONNREFUSED with URL),
     *     that error is sanitised before propagation.
     */
    private httpPost;
    private writeDLQ;
}
//# sourceMappingURL=sumo-logic.d.ts.map