ts-prorm-orm 1.1.0 → 1.2.0

package/dist/compliance/dsar-workflow.d.ts

@@ -0,0 +1,175 @@
+/**
+ * DSARWorkflow
+ *
+ * Manages the complete lifecycle of Data Subject Access Requests (DSARs).
+ * Tracks request status from creation through fulfillment and completion.
+ * Generates data exports for data subjects under GDPR, CCPA, HIPAA, and PIPEDA.
+ *
+ * Covers ~65 compliance frameworks including:
+ *   GDPR Art 15-22, CCPA, CPRA, LGPD, APPI, PIPA, PDPA, PoPI, DPDP India,
+ *   HIPAA Right to Access, PIPEDA, and all major data privacy regulations.
+ *
+ * Usage:
+ *   // Create a new access request
+ *   const request = await DSARWorkflow.createRequest('user-123', 'access');
+ *
+ *   // Check request status
+ *   const status = await DSARWorkflow.getRequestStatus(request.id);
+ *
+ *   // Fulfill the request (generate data export)
+ *   const fulfilled = await DSARWorkflow.fulfillRequest(request.id);
+ *
+ *   // Mark as complete
+ *   await DSARWorkflow.completeRequest(request.id);
+ *
+ *   // List all requests for a data subject
+ *   const allRequests = await DSARWorkflow.getRequestsForDataSubject('user-123');
+ */
+import { ExportOptions, ExportFormat } from './data-portability';
+import { ErasureOptions } from './right-to-erasure';
+/**
+ * Status of a DSAR request throughout its lifecycle.
+ */
+export type RequestStatus = 'pending' | 'in_progress' | 'pending_fulfillment' | 'fulfilled' | 'delivered' | 'completed' | 'rejected' | 'expired';
+/**
+ * Types of DSAR requests supported.
+ */
+export type RequestType = 'access' | 'rectification' | 'erasure' | 'portability' | 'restriction' | 'objection' | 'withdrawal';
+/**
+ * Options for fulfilling a DSAR request.
+ */
+export interface FulfillmentOptions {
+    /** Models to include in the data export */
+    models?: Array<{
+        model: any;
+        where?: Record<string, any>;
+    }>;
+    /** Export format - json, csv, or ndjson */
+    format?: ExportFormat;
+    /** Include associated models in export */
+    include?: any[];
+    /** Maximum records per model */
+    limit?: number;
+    /** Erasure options (only for requestType: 'erasure') */
+    erasureOptions?: ErasureOptions;
+    /** Custom export options for portability requests */
+    exportOptions?: ExportOptions;
+    /** Notes for the fulfillment */
+    notes?: string;
+}
+/**
+ * Complete DSAR request record.
+ */
+export interface DSARRequest {
+    /** Unique request identifier */
+    id: string;
+    /** ID of the data subject (user) */
+    dataSubjectId: string;
+    /** Type of request */
+    requestType: RequestType;
+    /** Current status in the workflow */
+    status: RequestStatus;
+    /** Date the request was created */
+    createdAt: Date;
+    /** Date request was last updated */
+    updatedAt: Date;
+    /** Date request was fulfilled */
+    fulfilledAt?: Date;
+    /** Date request was completed */
+    completedAt?: Date;
+    /** Date request was delivered to data subject */
+    deliveredAt?: Date;
+    /** Deadline for fulfilling the request (typically 30 days) */
+    deadline?: Date;
+    /** Export data if fulfilled */
+    exportData?: {
+        content: string;
+        format: ExportFormat;
+        recordCount: number;
+    };
+    /** Rejection reason if rejected */
+    rejectionReason?: string;
+    /** Notes from the compliance team */
+    notes?: string;
+    /** Compliance framework(s) this request is for */
+    frameworks: string[];
+    /** Whether the request was honored */
+    honored?: boolean;
+}
+export declare class DSARWorkflow {
+    /**
+     * Create a new DSAR request.
+     *
+     * @param dataSubjectId - The unique identifier for the data subject
+     * @param requestType - The type of DSAR request
+     * @returns The created DSAR request
+     */
+    static createRequest(dataSubjectId: string, requestType: RequestType): DSARRequest;
+    /**
+     * Get the status of a DSAR request.
+     *
+     * @param requestId - The request ID
+     * @returns The request if found, undefined otherwise
+     */
+    static getRequestStatus(requestId: string): DSARRequest | undefined;
+    /**
+     * Fulfill a DSAR request by generating the data export.
+     * For 'access' and 'portability' requests, generates data export.
+     * For 'erasure' requests, performs the erasure operation.
+     *
+     * @param requestId - The request ID
+     * @param options - Fulfillment options
+     * @returns The fulfilled request
+     */
+    static fulfillRequest(requestId: string, options?: FulfillmentOptions): Promise<DSARRequest>;
+    /**
+     * Mark a DSAR request as complete.
+     * Valid transitions: fulfilled -> delivered -> completed
+     *
+     * @param requestId - The request ID
+     * @returns The completed request
+     */
+    static completeRequest(requestId: string): DSARRequest;
+    /**
+     * Get all requests for a specific data subject.
+     *
+     * @param dataSubjectId - The data subject ID
+     * @returns Array of DSAR requests for the data subject
+     */
+    static getRequestsForDataSubject(dataSubjectId: string): DSARRequest[];
+    /**
+     * Get all requests of a specific status.
+     *
+     * @param status - The status to filter by
+     * @returns Array of DSAR requests with the specified status
+     */
+    static getRequestsByStatus(status: RequestStatus): DSARRequest[];
+    /**
+     * Get all pending requests that have exceeded their deadline.
+     *
+     * @returns Array of expired DSAR requests
+     */
+    static getExpiredRequests(): DSARRequest[];
+    /**
+     * Reject a DSAR request with a reason.
+     *
+     * @param requestId - The request ID
+     * @param reason - The rejection reason
+     * @returns The rejected request
+     */
+    static rejectRequest(requestId: string, reason: string): DSARRequest;
+    /**
+     * Start processing a request (transition from pending to in_progress).
+     *
+     * @param requestId - The request ID
+     * @returns The request in progress
+     */
+    static startProcessing(requestId: string): DSARRequest;
+    /**
+     * Mark a request as delivered to the data subject.
+     *
+     * @param requestId - The request ID
+     * @returns The delivered request
+     */
+    static markDelivered(requestId: string): DSARRequest;
+}

package/dist/compliance/field-encryption.d.ts

@@ -0,0 +1,84 @@
+/**
+ * FieldEncryption
+ *
+ * AES-256-GCM reversible field-level encryption for model attributes.
+ * Unlike the existing @Secure decorator (which one-way hashes passwords),
+ * this encrypts data so it can be decrypted — suitable for PII, PHI, and PCI data.
+ *
+ * Covers ~63 compliance frameworks including:
+ *   GDPR, HIPAA, PCI DSS, FIPS 140-2/140-3, NIST SP 800-111, PIPL, KVKK,
+ *   PDPA (multiple), SOC 2, ISO 27001, HITRUST, and more.
+ *
+ * Usage:
+ *   FieldEncryption.configure('32-byte-hex-key-here');
+ *
+ *   // Annotate fields:
+ *   Encrypt('ssn')(User);
+ *   Encrypt('creditCardNumber')(User);
+ *
+ *   // Apply hooks (once per model):
+ *   applyEncryptionHooks(User);
+ *
+ *   // Values are encrypted in the DB, transparent on read:
+ *   const user = await User.findByPk(1);
+ *   console.log(user.ssn); // plain text — decrypted automatically
+ */
+/**
+ * Configure the global encryption key.
+ * Call once at app startup before any encrypted models are used.
+ *
+ * @param key - A 32-byte key as a hex string (64 hex chars) or raw Buffer.
+ */
+export declare function configureFieldEncryption(key: string | Buffer): void;
+/**
+ * Encrypt a plain-text value.
+ * Returns a prefixed base64 string: "enc:v1:<iv>:<tag>:<ciphertext>"
+ */
+export declare function encryptValue(plain: string): string;
+/**
+ * Decrypt a value produced by encryptValue().
+ * Returns the original plain-text string.
+ */
+export declare function decryptValue(ciphertext: string): string;
+/** Checks whether a value is already in encrypted form (prefixed with `enc:v1:`), used to avoid double-encrypting. */
+declare function isEncrypted(value: string): boolean;
+/**
+ * Get the list of fields marked for encryption on a model class.
+ */
+export declare function getEncryptedFields(target: Function): string[];
+/**
+ * Mark a field for AES-256-GCM encryption.
+ * Apply as a class decorator, passing the field name(s).
+ *
+ *   Encrypt('ssn')(User);
+ *   Encrypt('bankAccount')(User);
+ *
+ * Then call applyEncryptionHooks(User) once to wire the hooks.
+ */
+export declare function Encrypt(field: string): (target: Function) => void;
+/**
+ * Wire beforeSave and afterFind hooks onto a model to transparently
+ * encrypt on write and decrypt on read.
+ *
+ * Call once per model after it is defined:
+ *   applyEncryptionHooks(User);
+ */
+export declare function applyEncryptionHooks(ModelClass: any): void;
+/**
+ * Convenience class grouping the encryption API.
+ */
+export declare class FieldEncryption {
+    /** Configure the global AES-256-GCM key. */
+    static configure: typeof configureFieldEncryption;
+    /** Manually encrypt a value. */
+    static encrypt: typeof encryptValue;
+    /** Manually decrypt a value. */
+    static decrypt: typeof decryptValue;
+    /** Check if a value is already encrypted. */
+    static isEncrypted: typeof isEncrypted;
+    /** Wire hooks onto a model. */
+    static applyHooks: typeof applyEncryptionHooks;
+    /** Get the list of encrypted fields on a model. */
+    static getFields: typeof getEncryptedFields;
+}
+export {};

package/dist/compliance/immutable-record.d.ts

@@ -0,0 +1,84 @@
+/**
+ * ImmutableRecord
+ *
+ * Prevents UPDATE and DELETE on a model. Only CREATE and READ are allowed.
+ * Provides an `append()` method for creating new versions of immutable data,
+ * optionally with soft versioning (storing the version number).
+ *
+ * Covers ~14 compliance frameworks including:
+ *   SOX, SEC 17a-4 (WORM), 21 CFR Part 11, EU Annex 11, ALCOA+,
+ *   GAMP 5, ICH E6 GCP, NATO STANAG, and financial audit requirements.
+ *
+ * Usage:
+ *   // Make a model immutable:
+ *   ImmutableRecord.makeImmutable(FinancialEntry);
+ *
+ *   // Now attempting to update/delete throws:
+ *   await entry.update({ amount: 100 }); // throws Error
+ *   await entry.destroy();              // throws Error
+ *
+ *   // Instead, create a new version:
+ *   const newEntry = await FinancialEntry.append({
+ *     amount: 100,
+ *     description: 'Q3 adjustment',
+ *   }, { parentId: entry.id });
+ *
+ *   // Enable soft versioning (tracks version numbers):
+ *   ImmutableRecord.enableVersioning(FinancialEntry, { versionField: 'version' });
+ */
+export interface ImmutableOptions {
+    /** If true, DELETE attempts are silently ignored instead of throwing. Default: false (throws) */
+    silentDelete?: boolean;
+    /** If true, allows CREATE but blocks UPDATE/DELETE. Default: true */
+    allowCreate?: boolean;
+}
+export interface VersionOptions {
+    /** The field name to store the version number. Default: 'version' */
+    versionField?: string;
+    /** The field name for the parent record ID (for audit trail). Default: 'previousId' */
+    parentField?: string;
+    /** Starting version number. Default: 1 */
+    startAt?: number;
+}
+/**
+ * Mark a model as immutable — blocks UPDATE and DELETE.
+ *
+ * @param Model    - The model class to protect
+ * @param options  - Immutable configuration options
+ */
+export declare function makeImmutable(Model: any, options?: ImmutableOptions): void;
+/**
+ * Enable soft versioning on an immutable model.
+ * Adds version and previousId fields, and auto-increments on append.
+ *
+ * @param Model    - The model class
+ * @param options  - Version field configuration
+ */
+export declare function enableVersioning(Model: any, options?: VersionOptions): void;
+/**
+ * Check if a model is configured as immutable.
+ */
+export declare function isImmutable(Model: any): boolean;
+/**
+ * Check if an immutable model has versioning enabled.
+ */
+export declare function hasVersioning(Model: any): boolean;
+/**
+ * Get the version configuration for an immutable model.
+ */
+export declare function getVersionConfig(Model: any): Required<VersionOptions> | undefined;
+/**
+ * Get all immutable models registered.
+ */
+export declare function listImmutableModels(): Array<{
+    model: any;
+    options: ImmutableOptions;
+}>;
+export declare class ImmutableRecord {
+    static makeImmutable: typeof makeImmutable;
+    static enableVersioning: typeof enableVersioning;
+    static isImmutable: typeof isImmutable;
+    static hasVersioning: typeof hasVersioning;
+    static getVersionConfig: typeof getVersionConfig;
+    static listImmutableModels: typeof listImmutableModels;
+}

package/dist/compliance/index.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Compliance Module
+ *
+ * A set of 12 reusable classes for addressing data storage requirements
+ * from 218+ security and compliance frameworks.
+ *
+ * Each class wraps existing ORM infrastructure (hooks, decorators, scopes)
+ * into simple one-liner APIs.
+ *
+ * ---
+ *
+ * Quick reference:
+ *
+ *   // 1. Audit trail for all CRUD operations
+ *   import { ComplianceAuditTrail } from './compliance/audit-trail';
+ *   ComplianceAuditTrail.enable(prorm, UserModel, { getUserId: () => user.id });
+ *
+ *   // 2. Field-level AES-256-GCM encryption
+ *   import { FieldEncryption } from './compliance/field-encryption';
+ *   FieldEncryption.configure('32-byte-hex-key');
+ *   @Encrypt('ssn') class User extends Model {}
+ *   applyEncryptionHooks(User);
+ *
+ *   // 3. TLS enforcement at connection time
+ *   import { TLSEnforcer } from './compliance/tls-enforcer';
+ *   TLSEnforcer.enforce(prorm);
+ *
+ *   // 4. Data retention / TTL policies
+ *   import { DataRetentionPolicy } from './compliance/data-retention';
+ *   DataRetentionPolicy.set(FinancialRecord, { maxAge: { years: 7 } });
+ *   await DataRetentionPolicy.purge(FinancialRecord);
+ *
+ *   // 5. Right to erasure (DSAR response)
+ *   import { RightToErasure } from './compliance/right-to-erasure';
+ *   await RightToErasure.erase(User, { where: { id: userId } }, { mode: 'anonymize' });
+ *
+ *   // 6. Consent record storage
+ *   import { ConsentRecord } from './compliance/consent-record';
+ *   await ConsentRecord.initialize(prorm);
+ *   await ConsentRecord.grant({ subjectId: userId, purpose: 'marketing' });
+ *
+ *   // 7. Row-level security (tenant filtering)
+ *   import { RowLevelSecurity } from './compliance/row-level-security';
+ *   RowLevelSecurity.apply(Document, ctx => ({ where: { tenantId: ctx.tenantId } }));
+ *
+ *   // 8. Data masking in query output
+ *   import { DataMasker } from './compliance/data-masker';
+ *   DataMasker.maskField(User, 'ssn', { pattern: 'ssn' });
+ *   const masked = DataMasker.mask(user, 'admin');
+ *
+ *   // 9. Immutable records (append-only, no update/delete)
+ *   import { ImmutableRecord } from './compliance/immutable-record';
+ *   ImmutableRecord.makeImmutable(AuditEntry);
+ *
+ *   // 10. Pseudonymization / tokenization
+ *   import { PseudonymizationService } from './compliance/pseudonymization';
+ *   await PseudonymizationService.configure({ secretKey: '...' });
+ *   const token = await PseudonymizationService.tokenize('user-123');
+ *
+ *   // 11. Data portability (DSAR export)
+ *   import { DataPortabilityExporter } from './compliance/data-portability';
+ *   const export = await DataPortabilityExporter.export(User, { where: { id: userId } });
+ *
+ *   // 12. Data classification / sensitivity tagging
+ *   import { DataClassifier } from './compliance/data-classifier';
+ *   @FieldClassification('email', 'PII') class User extends Model {}
+ *   const piiFields = DataClassifier.getPIIFields(User);
+ */
+export { ComplianceAuditTrail, AuditTrailOptions } from './audit-trail';
+export { FieldEncryption, configureFieldEncryption, encryptValue, decryptValue, Encrypt, applyEncryptionHooks, getEncryptedFields, } from './field-encryption';
+export { TLSEnforcer, TLSEnforcerOptions, TLSMode } from './tls-enforcer';
+export { DataRetentionPolicy, RetentionDuration, RetentionExpiryMode, RetentionPolicyOptions, } from './data-retention';
+export { RightToErasure, ErasureMode, CascadeTarget, ErasureOptions, ErasureResult, } from './right-to-erasure';
+export { ConsentRecord, LegalBasis, LegalBasisEnum, ConsentGrantOptions, ConsentWithdrawOptions, } from './consent-record';
+export { ConsentVersioning, ConsentVersion, ConsentHistoryOptions, ConsentType, RecordConsentOptions, } from './consent-versioning';
+export { RowLevelSecurityAPI as RowLevelSecurity, RLS, SecurityContext, ScopeSelector, initRLS, apply, setContext, getContext, runInContext, rlsMiddleware, registerHooks, } from './row-level-security';
+export { DataMasker, MaskPattern, MaskPatternEnum, MaskOptions, Mask, maskField, maskValue, mask, maskMany, applyHooks as applyMaskingHooks, } from './data-masker';
+export { ImmutableRecord, ImmutableOptions, VersionOptions, makeImmutable, enableVersioning, isImmutable, } from './immutable-record';
+export { PseudonymizationService, PseudonymizationConfig, StorageMode, configure, tokenize, detokenize, Pseudonymize, applyHooks as applyPseudonymizationHooks, } from './pseudonymization';
+export { DataPortabilityExporter, ExportFormat, ExportOptions, StreamExportOptions, exportData, exportStream, createDSARResponse, } from './data-portability';
+export { DataClassifier, SensitivityLevel, DataCategory, ClassificationMetadata, Classify, FieldClassification, getClassification, getPIIFields, getPHIFields, getPCIFields, isSensitive, autoDiscover, } from './data-classifier';
+export { Security, SecurityFramework, SecurityFrameworkType, AllFrameworks, FrameworkCategories, FrameworkRequirements, FrameworkCount, isValidFramework, getFrameworkCategory, getAllFrameworks, setupSecurity, setupAllSecurity, Table, TableSecurityOptions, Database as DatabaseSecurity, DatabaseSecurityOptions, getTableSecurity, getDatabaseSecurity, getSecurityFrameworks, hasAudit, isImmutableModel, } from './security-decorator';
+export { SecurityMonitor, SecurityMonitorOptions, ComplianceSecurityMonitor, AlertSeverity, AlertCategory, SecurityAlert, getGlobalMonitor, initSecurityMonitor, analyzeQuerySecurity, } from './security-monitor';
+export { BreachDetector, BreachDetectorOptions, BreachSeverity, BreachCategory, BreachAlert, getGlobalBreachDetector, initBreachDetector, } from './breach-detector';
+export { SessionIsolation, TenantIsolation, TenantContext, TenantKey, SessionInfo, SessionIsolationOptions, TenantIsolationDecoratorOptions, SessionStore, KeyStore, sessionIsolationMiddleware, getTenantAuditMetadata, getTenantIsolationOptions, } from './session-isolation';
+export { WORMStorage, WORMOptions, WORMTamperLog, ArchiveState, WORM, getWORMOptions, applyWORMHooks, isFrozen, isArchived, } from './worm-storage';
+export { RateLimiter, RateLimiterOptions, RateLimitConfig, RateLimitAction, RateLimitInfo, RateLimitResult, RateLimitStats, RateLimit, getRateLimitOptions, getGlobalLimiter, initRateLimiter, checkRateLimit, satisfiesCompliance, getRecommendedLimits, } from './rate-limiter';
+export { SensitiveDataDiscovery, SensitiveDataType, ComplianceFramework, SensitiveField, DiscoveryPattern, ScanOptions, ScanResult, registerPattern, unregisterPattern, getPatterns, generateComplianceReport, } from './sensitive-data-discovery';
+export { CrossBorderLog, TransferRecord, RegionConfig, TransferOptions, TransferStatus, DataTypeCategory, RegionCode, getComplianceTransfers, generateTransferReport, } from './cross-border-log';
+export { DSARWorkflow, DSARRequest, RequestStatus, RequestType, FulfillmentOptions, } from './dsar-workflow';
+export { PrivacyImpactAssessment, AssessmentStatus, RiskSeverity, PIARecord, RiskRecord, PIACreateOptions, RiskRecordOptions, } from './privacy-impact-assessment';
+export { BackupVerification, BackupSource, BackupConfig, BackupMetadata, VerificationResult, VerificationSchedule, VerificationHistoryEntry, } from './backup-verification';
+export { QueryFirewall, FirewallRule, FirewallRuleType, FirewallMode, FirewallModeEnum, FirewallOptions, QueryAnalysis, QueryOperation, BlockedQuery, getRecommendedRules, FIREWALL_RULES, OWASP_SQL_INJECTION_PATTERNS, CIS_BENCHMARK_RULES, PCI_DSS_RULES, HIPAA_RULES, SOX_RULES, NIST_CSF_RULES, POSTGRESQL_RULES, MYSQL_RULES, MARIADB_RULES, MSSQL_RULES, ORACLE_RULES, SQLITE_RULES, DATABASE_RULES, DatabaseType, FirewallRules, FirewallRuleDecoratorOptions, PostgreSQLFirewall, MySQLFirewall, MariaDBFirewall, MSSQLFirewall, OracleFirewall, SQLiteFirewall, applyFirewallRulesToModel, } from './query-firewall';

package/dist/compliance/privacy-impact-assessment.d.ts

@@ -0,0 +1,196 @@
+/**
+ * PrivacyImpactAssessment
+ *
+ * A ready-made model and service for conducting Privacy Impact Assessments (PIA)
+ * and Data Protection Impact Assessments (DPIA) for high-risk data processing.
+ *
+ * Covers compliance frameworks including:
+ *   GDPR Art. 35 (DPIA), ISO 27701, UK GDPR, CCPA, PIPEDA,
+ *   LGPD (Brazil), APPI (Japan), PDPA (Thailand, Singapore), and more.
+ *
+ * Usage:
+ *   // Initialize once (creates the pia_assessments table):
+ *   await PrivacyImpactAssessment.initialize(prorm);
+ *
+ *   // Create a new PIA:
+ *   const assessment = await PrivacyImpactAssessment.createAssessment(
+ *     'User Analytics Processing',
+ *     ['email', 'ip_address', 'behavioral_data'],
+ *     'analyze_user_behavior_for_product_improvement'
+ *   );
+ *
+ *   // Record identified risks:
+ *   await PrivacyImpactAssessment.recordRisk(
+ *     assessment.id,
+ *     'Potential data breach exposing user profiles',
+ *     'high',
+ *   *   'Implement AES-256 encryption at rest and TLS 1.3 in transit'
+ *   );
+ *
+ *   // Approve the assessment:
+ *   await PrivacyImpactAssessment.approveAssessment(assessment.id, 'DPO John Smith');
+ *
+ *   // Link to a model:
+ *   await PrivacyImpactAssessment.linkToModel(assessment.id, UserAnalytics);
+ *
+ *   // Get assessment details:
+ *   const details = await PrivacyImpactAssessment.getAssessment(assessment.id);
+ */
+/**
+ * Status of a Privacy Impact Assessment
+ */
+export type AssessmentStatus = 'draft' | 'in_review' | 'approved' | 'rejected' | 'archived';
+/**
+ * Severity level of identified risks
+ */
+export type RiskSeverity = 'low' | 'medium' | 'high' | 'critical';
+/**
+ * PIA Record containing assessment metadata
+ */
+export interface PIARecord {
+    id: number;
+    name: string;
+    dataTypes: string[];
+    processingPurpose: string;
+    status: AssessmentStatus;
+    approvedBy?: string;
+    approvedAt?: Date;
+    linkedModels?: string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+/**
+ * Risk record associated with a PIA
+ */
+export interface RiskRecord {
+    id: number;
+    assessmentId: number;
+    risk: string;
+    severity: RiskSeverity;
+    mitigation: string;
+    createdAt: Date;
+}
+/**
+ * Options for creating a new PIA
+ */
+export interface PIACreateOptions {
+    /** Name/title of the assessment */
+    name: string;
+    /** List of data types being processed (e.g. ['email', 'ssn', 'health_data']) */
+    dataTypes: string[];
+    /** Purpose of the processing operation */
+    processingPurpose: string;
+    /** Additional metadata about the assessment */
+    metadata?: Record<string, any>;
+}
+/**
+ * Options for recording a risk
+ */
+export interface RiskRecordOptions {
+    /** Description of the identified risk */
+    risk: string;
+    /** Severity level of the risk */
+    severity: RiskSeverity;
+    /** Mitigation measure for the risk */
+    mitigation: string;
+}
+export declare class PrivacyImpactAssessment {
+    /**
+     * Initialize the PrivacyImpactAssessment model and sync the tables.
+     * Call once at application startup.
+     *
+     * @param prorm - The Prorm instance
+     * @param tableName - Override the default table name 'pia_assessments'
+     */
+    static initialize(prorm: any, tableName?: string): Promise<void>;
+    private static requireModels;
+    /**
+     * Create a new Privacy Impact Assessment.
+     *
+     * @param name - Name/title of the assessment
+     * @param dataTypes - List of data types being processed
+     * @param processingPurpose - Purpose of the processing operation
+     * @returns The created PIA record
+     */
+    static createAssessment(name: string, dataTypes: string[], processingPurpose: string): Promise<PIARecord>;
+    /**
+     * Record a risk associated with a PIA assessment.
+     *
+     * @param assessmentId - The ID of the assessment to add the risk to
+     * @param risk - Description of the identified risk
+     * @param severity - Severity level of the risk
+     * @param mitigation - Mitigation measures for the risk
+     * @returns The created risk record
+     */
+    static recordRisk(assessmentId: number, risk: string, severity: RiskSeverity, mitigation: string): Promise<RiskRecord>;
+    /**
+     * Approve a Privacy Impact Assessment.
+     * Sets status to 'approved' and records approver information.
+     *
+     * @param assessmentId - The ID of the assessment to approve
+     * @param approver - Name/ID of the approver (e.g., DPO name)
+     * @returns The updated PIA record
+     */
+    static approveAssessment(assessmentId: number, approver: string): Promise<PIARecord>;
+    /**
+     * Get a Privacy Impact Assessment by ID.
+     * Includes associated risks.
+     *
+     * @param assessmentId - The ID of the assessment to retrieve
+     * @returns The PIA record with associated risks
+     */
+    static getAssessment(assessmentId: number): Promise<any>;
+    /**
+     * Link a model to a PIA assessment.
+     * Useful for tracking which models are covered by the assessment.
+     *
+     * @param assessmentId - The ID of the assessment
+     * @param model - The model class to link (can be a Prorm model or string name)
+     * @returns The updated PIA record
+     */
+    static linkToModel(assessmentId: number, model: any): Promise<PIARecord>;
+    /**
+     * Get all assessments with a specific status.
+     *
+     * @param status - The status to filter by
+     * @returns Array of PIA records matching the status
+     */
+    static getByStatus(status: AssessmentStatus): Promise<PIARecord[]>;
+    /**
+     * Reject a Privacy Impact Assessment.
+     *
+     * @param assessmentId - The ID of the assessment to reject
+     * @param reason - Reason for rejection
+     * @returns The updated PIA record
+     */
+    static rejectAssessment(assessmentId: number, reason: string): Promise<PIARecord>;
+    /**
+     * Submit an assessment for review.
+     * Changes status from 'draft' to 'in_review'.
+     *
+     * @param assessmentId - The ID of the assessment to submit
+     * @returns The updated PIA record
+     */
+    static submitForReview(assessmentId: number): Promise<PIARecord>;
+    /**
+     * Get all risks for an assessment grouped by severity.
+     *
+     * @param assessmentId - The ID of the assessment
+     * @returns Object with risks grouped by severity level
+     */
+    static getRisksBySeverity(assessmentId: number): Promise<Record<RiskSeverity, RiskRecord[]>>;
+    /**
+     * Check if an assessment has any high or critical risks without mitigations.
+     *
+     * @param assessmentId - The ID of the assessment
+     * @returns True if there are unresolved high-risk items
+     */
+    static hasUnresolvedHighRisks(assessmentId: number): Promise<boolean>;
+    /**
+     * List all models linked to a PIA assessment.
+     *
+     * @param assessmentId - The ID of the assessment
+     * @returns Array of linked model names
+     */
+    static getLinkedModels(assessmentId: number): Promise<string[]>;
+}