/**
 * Audit helpers for organization settings and admin changes: the default
 * model, the personal-key restriction, service providers, storage, Builder.io
 * connections, and member roles.
 *
 * These events are recorded with `admins` visibility, so owners and admins of
 * the org read them in the organization trail (`list-audit-events` with
 * `scope: "organization"`), the actor reads their own, and other members read
 * none. Without an org the event stays private to the actor.
 *
 * Kept free of DB imports so action modules can import `orgAdminAudit`; the
 * route recorder loads `record.js` on first use, like `action.ts` does.
 */
import { type AuditAttribution } from "./attribution.js";
import type { ActionAuditConfig, AuditCallMeta, AuditStatus, AuditTarget } from "./types.js";
export declare function orgAdminAuditTarget(type: string, id: string | null | undefined, orgId: string | null | undefined): AuditTarget;
/**
 * `audit` config for a `defineAction` that changes organization settings or
 * membership. Refused calls are recorded too: a thrown 401/403 records as
 * `denied`.
 */
export declare function orgAdminAudit(options: {
    targetType: string;
    targetId?: (args: any, result: unknown, meta: AuditCallMeta) => string | null | undefined;
    summary?: (args: any, result: unknown, meta: AuditCallMeta) => string;
    recordInputs?: boolean;
}): ActionAuditConfig;
export interface OrgAdminAuditEventInput {
    /** Name recorded as the event's action, e.g. `builder-connect`. */
    action: string;
    targetType: string;
    targetId?: string | null;
    summary: string;
    userEmail: string | null | undefined;
    orgId: string | null | undefined;
    status?: AuditStatus;
    /**
     * `auditAttribution(ctx)` inside an action, `routeAuditAttribution(event)`
     * in a route.
     */
    attribution: AuditAttribution;
    /** Recorded as the event's (redacted) input. */
    args?: Record<string, unknown>;
    /**
     * The change affects only the actor (a member's own connection), so it stays
     * in their private trail even inside an org.
     */
    personal?: boolean;
}
/**
 * Record an organization settings or admin change from code that is not a
 * `defineAction` run, such as a Nitro route. Best-effort like every audit
 * write: it never throws for a recording failure. It does throw
 * `AuditAttributionError` when `attribution` is missing.
 */
export declare function recordOrgAdminAuditEvent(input: OrgAdminAuditEventInput): Promise<void>;