/**
 * Core audit types and query functions.
 *
 * AuditEntry interface and queryAudit function moved here from
 * src/dispatch/middleware/audit.ts so core modules (session-grade.ts)
 * can use them without importing from the dispatch layer.
 *
 * @task T5715
 * @epic T5701
 * @task T1261 PSYCHE E4 — appendContractViolation for contract-violations.jsonl
 */
import type { ContractViolationRecord } from '@cleocode/contracts';
import type { GatewaySource } from '@cleocode/contracts/gateway';
/**
 * Audit entry interface.
 * Used by session-grade and system-engine for behavioral analysis.
 */
export interface AuditEntry {
    timestamp: string;
    sessionId: string | null;
    domain: string;
    operation: string;
    params: Record<string, unknown>;
    result: {
        success: boolean;
        exitCode: number;
        duration: number;
    };
    metadata: {
        taskId?: string;
        userId?: string;
        /**
         * Transport that issued the request. Accepts every {@link GatewaySource}
         * (R3 widened the gateway from CLI-only to cli|mcp|rpc|http); the legacy
         * `'dispatch'` value is retained so historical audit logs still parse.
         */
        source: GatewaySource | 'dispatch';
        gateway?: 'mutate' | 'query';
    };
    error?: string;
}
/** Relative path within project root for contract violation audit log. */
export declare const CONTRACT_VIOLATIONS_FILE = ".cleo/audit/contract-violations.jsonl";
/**
 * Append a {@link ContractViolationRecord} to the project's contract-violations
 * audit log at `.cleo/audit/contract-violations.jsonl`.
 *
 * Follows the same append-only pattern as force-bypass.jsonl (ADR-039): each
 * line is standalone JSON; the file is created on first write. Errors are
 * swallowed so audit writes never block playbook execution.
 *
 * @param projectRoot - Absolute path to the CLEO project root.
 * @param record - Violation data (timestamp is set automatically when omitted).
 *
 * @example
 * ```ts
 * import { appendContractViolation } from '@cleocode/core/audit.js';
 *
 * appendContractViolation('/project', {
 *   runId: 'run_abc123',
 *   nodeId: 'validate',
 *   field: 'requires',
 *   key: 'diff',
 *   message: 'requires.fields[diff] not present in context',
 *   playbookName: 'ivtr',
 * });
 * ```
 *
 * @task T1261 PSYCHE E4
 */
export declare function appendContractViolation(projectRoot: string, record: Omit<ContractViolationRecord, 'timestamp'> & {
    timestamp?: string;
}): void;
/**
 * Query audit entries from SQLite audit_log table.
 * Used by session-grade.ts for behavioral analysis.
 *
 * Returns entries ordered chronologically (ASC) to preserve
 * behavioral sequence for grading analysis.
 */
export declare function queryAudit(options?: {
    sessionId?: string;
    domain?: string;
    operation?: string;
    taskId?: string;
    since?: string;
    limit?: number;
}): Promise<AuditEntry[]>;
//# sourceMappingURL=audit.d.ts.map