/**
 * Pure (no-DB) audit configuration helpers.
 *
 * Kept free of any database / store import so `action.ts` can statically
 * import them without pulling the DB client into every bundle that touches an
 * action. The DB-touching recorder lives in `record.ts`, which `action.ts`
 * loads lazily via dynamic import on first audited call.
 */
import type { ActionAuditConfig, AuditActorKind, AuditStatus } from "./types.js";
/** Normalize a raw `audit` option into a config object (or undefined). */
export declare function normalizeAuditConfig(raw: unknown): ActionAuditConfig | undefined;
/**
 * Whether to attach the audit wrapper to an action at definition time. Decided
 * from the action's resolved `readOnly` flag plus its config — the action's
 * *name* isn't known here (it's the registry key), so name-based skipping
 * happens later in `shouldRecordAudit`.
 */
export declare function resolveAuditAttach(config: ActionAuditConfig | undefined, readOnly: boolean | undefined): boolean;
/**
 * Final, name-aware decision made at record time. Explicit `enabled: true`
 * overrides the high-frequency denylist; otherwise denylisted names are
 * dropped.
 */
export declare function shouldRecordAudit(config: ActionAuditConfig | undefined, actionName: string): boolean;
/** Derive the actor kind from the invocation surface + resolved identity. */
export declare function deriveActorKind(caller: string | undefined, actorEmail: string | undefined | null): AuditActorKind;
/** Whether the whole subsystem is disabled via env. */
export declare function isAuditDisabled(): boolean;
export type { AuditStatus };
//# sourceMappingURL=config.d.ts.map