import type { ID, Timestamp } from '../../common/types.js';
/**
 * Evidence types that can be collected
 */
export declare const EVIDENCE_EVENT_TYPES: readonly ["audit", "policy_change", "access_decision", "trust_score_change", "escalation_decision", "data_retention"];
export type EvidenceEventType = (typeof EVIDENCE_EVENT_TYPES)[number];
/**
 * Filter options for evidence collection
 */
export interface EvidenceCollectionFilter {
    /** Tenant ID (required) */
    tenantId: ID;
    /** Start date for collection period */
    startDate: Date;
    /** End date for collection period */
    endDate: Date;
    /** Event types to include (defaults to all) */
    eventTypes?: EvidenceEventType[];
    /** Include full payloads (defaults to false for summary data) */
    includePayloads?: boolean;
    /** Maximum records per event type */
    limit?: number;
}
/**
 * Collected audit event
 */
export interface CollectedAuditEvent {
    id: string;
    timestamp: Timestamp;
    eventType: string;
    category: string;
    severity: string;
    actorId: string;
    actorType: string;
    actorName?: string;
    action: string;
    resourceType: string;
    resourceId: string;
    resourceName?: string;
    outcome: string;
    reason?: string;
    tenantId: ID;
    requestId?: string;
    traceId?: string;
    metadata?: Record<string, unknown>;
}
/**
 * Collected policy change record
 */
export interface CollectedPolicyChange {
    id: string;
    timestamp: Timestamp;
    policyId: string;
    policyName: string;
    version: string;
    previousVersion?: string;
    changeType: 'created' | 'updated' | 'published' | 'deprecated' | 'archived';
    changedBy: string;
    changedByType: string;
    changeDescription?: string;
    diff?: {
        before?: Record<string, unknown>;
        after?: Record<string, unknown>;
    };
}
/**
 * Collected access decision
 */
export interface CollectedAccessDecision {
    id: string;
    timestamp: Timestamp;
    intentId: string;
    entityId: string;
    entityType: string;
    action: string;
    resource: string;
    decision: 'granted' | 'denied';
    reason?: string;
    trustScore?: number;
    trustLevel?: number;
    policyEvaluated?: string[];
    constraintsApplied?: string[];
}
/**
 * Collected trust score change
 */
export interface CollectedTrustScoreChange {
    id: string;
    timestamp: Timestamp;
    entityId: string;
    entityType: string;
    previousScore: number;
    newScore: number;
    previousLevel: number;
    newLevel: number;
    changeReason: string;
    signalType?: string;
    signalSource?: string;
}
/**
 * Collected escalation decision
 */
export interface CollectedEscalationDecision {
    id: string;
    timestamp: Timestamp;
    escalationId: string;
    intentId: string;
    reason: string;
    escalatedTo: string;
    status: 'pending' | 'approved' | 'rejected' | 'timeout';
    resolvedBy?: string;
    resolvedAt?: Timestamp;
    resolutionNotes?: string;
    timeToResolution?: number;
}
/**
 * Collected data retention log
 */
export interface CollectedDataRetentionLog {
    id: string;
    timestamp: Timestamp;
    operation: 'archive' | 'purge' | 'delete' | 'anonymize';
    dataType: string;
    recordCount: number;
    retentionPolicy: string;
    triggeredBy: 'scheduled' | 'manual' | 'gdpr_request';
    requestId?: string;
    success: boolean;
    errorMessage?: string;
}
/**
 * Complete evidence collection result
 */
export interface EvidenceCollection {
    /** Collection metadata */
    metadata: {
        collectionId: string;
        tenantId: ID;
        collectedAt: Timestamp;
        periodStart: Timestamp;
        periodEnd: Timestamp;
        collectorVersion: string;
        eventTypesIncluded: EvidenceEventType[];
        includePayloads: boolean;
    };
    /** Collected evidence by type */
    auditEvents: CollectedAuditEvent[];
    policyChanges: CollectedPolicyChange[];
    accessDecisions: CollectedAccessDecision[];
    trustScoreChanges: CollectedTrustScoreChange[];
    escalationDecisions: CollectedEscalationDecision[];
    dataRetentionLogs: CollectedDataRetentionLog[];
    /** Summary statistics */
    summary: {
        totalRecords: number;
        byEventType: Record<EvidenceEventType, number>;
        byOutcome: Record<string, number>;
        bySeverity: Record<string, number>;
    };
}
/**
 * Collector for compliance evidence
 *
 * Aggregates audit events, policy changes, access decisions, and other
 * compliance-relevant data for export to external auditors.
 */
export declare class EvidenceCollector {
    private db;
    private initialized;
    private readonly collectorVersion;
    constructor();
    /**
     * Initialize the collector
     */
    initialize(): Promise<void>;
    /**
     * Ensure collector is initialized
     */
    private ensureInitialized;
    /**
     * Collect all evidence based on filters
     */
    collectEvidence(filter: EvidenceCollectionFilter): Promise<EvidenceCollection>;
    /**
     * Collect audit events from the audit log
     */
    private collectAuditEvents;
    /**
     * Collect policy change events
     */
    private collectPolicyChanges;
    /**
     * Map policy event type to change type
     */
    private mapPolicyEventToChangeType;
    /**
     * Collect access control decisions
     */
    private collectAccessDecisions;
    /**
     * Collect trust score change events
     */
    private collectTrustScoreChanges;
    /**
     * Collect escalation decision events
     */
    private collectEscalationDecisions;
    /**
     * Map escalation event type to status
     */
    private mapEscalationEventToStatus;
    /**
     * Collect data retention enforcement logs
     */
    private collectDataRetentionLogs;
    /**
     * Map data event type to operation
     */
    private mapDataEventToOperation;
    /**
     * Calculate summary statistics for the collection
     */
    private calculateSummary;
    /**
     * Get event counts by category for a time period
     */
    getEventCounts(tenantId: ID, startDate: Date, endDate: Date): Promise<Record<string, number>>;
    /**
     * Get event counts by time period (hourly, daily, weekly)
     */
    getEventCountsByPeriod(tenantId: ID, startDate: Date, endDate: Date, period: 'hour' | 'day' | 'week'): Promise<Array<{
        period: string;
        count: number;
    }>>;
}
/**
 * Get the singleton evidence collector instance
 */
export declare function getEvidenceCollector(): EvidenceCollector;
/**
 * Reset the singleton (for testing)
 */
export declare function resetEvidenceCollector(): void;
//# sourceMappingURL=evidence-collector.d.ts.map