import type { AuditEvent, AuditQueryFilters } from "./types.js";
export declare const AGENT_AUDIT_LOG_CREATE_SQL = "\n  CREATE TABLE IF NOT EXISTS agent_audit_log (\n    id TEXT PRIMARY KEY,\n    created_at BIGINT NOT NULL,\n    action TEXT NOT NULL,\n    caller TEXT NOT NULL,\n    actor_kind TEXT NOT NULL,\n    -- guard:allow-identity-column - immutable audit attribution\n    actor_email TEXT,\n    org_id TEXT,\n    thread_id TEXT,\n    turn_id TEXT,\n    target_type TEXT,\n    target_id TEXT,\n    status TEXT NOT NULL DEFAULT 'success',\n    summary TEXT,\n    input TEXT,\n    error_code TEXT,\n    -- guard:allow-identity-column - immutable audit ownership snapshot\n    owner_email TEXT,\n    visibility TEXT NOT NULL DEFAULT 'private',\n    run_id TEXT,\n    task_id TEXT,\n    parent_task_id TEXT,\n    source_kind TEXT,\n    source_platform TEXT,\n    source_id TEXT,\n    source_url TEXT,\n    network_protocol TEXT,\n    network_id TEXT,\n    network_peer TEXT\n  )\n";
export declare const auditStore: import("../db/store-registry.js").Store;
export declare function ensureAuditTables(): Promise<void>;
export declare function insertAuditEvent(event: AuditEvent): Promise<void>;
/**
 * `accessible` (the default) is every row the caller may read: their own plus
 * the rows shared with their org. `organization` is only the org's shared
 * trail (`org` and, for owners and admins, `admins` rows), without the
 * caller's private rows.
 */
export type AuditTrail = "accessible" | "organization";
export interface AuditReadScope {
    userEmail?: string;
    orgId?: string | null;
    /**
     * The caller is an owner or admin of `orgId`, so `admins` rows are readable.
     * Set it from `resolveAuditReadScope`, never from a client claim.
     */
    orgAdmin?: boolean;
    trail?: AuditTrail;
}
export declare const MAX_LIMIT = 500;
export declare function queryAuditEvents(scope: AuditReadScope, filters?: AuditQueryFilters): Promise<AuditEvent[]>;
export interface AuditEventPage {
    events: AuditEvent[];
    /** More rows match past this page. */
    hasMore: boolean;
    /** `offset` for the next page, or null when this page is the last. */
    nextOffset: number | null;
}
/** One page of {@link queryAuditEvents}, plus whether another page exists. */
export declare function queryAuditEventPage(scope: AuditReadScope, filters?: AuditQueryFilters): Promise<AuditEventPage>;
/**
 * The distinct apps that recorded rows the scope can read, ignoring every
 * other filter, so an app filter lists the same choices while it narrows.
 * Rows with no recorded app are not a choice.
 */
export declare function queryAuditApps(scope: AuditReadScope): Promise<string[]>;
export declare function getAuditEventById(id: string, scope: AuditReadScope): Promise<AuditEvent | null>;
export declare function deleteOldAuditEvents(cutoffMs: number): Promise<number>;
export declare function __resetAuditInitForTests(): void;