/**
 * Skills-guard audit log writer — appends a structured entry to
 * `.cleo/audit/skill-trust-bypass.jsonl` every time the operator overrides
 * a `block` install decision with `--force`.
 *
 * Mirrors the {@link https://github.com/kryptobaseddev/cleocode/blob/main/.cleo/audit/force-bypass.jsonl `.cleo/audit/force-bypass.jsonl`}
 * pattern used by ADR-051 evidence overrides — same JSONL shape, separate
 * file so security audits can grep for trust-related bypasses without
 * noise from completion overrides.
 *
 * @task T9730
 * @epic T9564
 */
import type { ScanResult } from './skills-guard.js';
/**
 * Wire shape of one audit entry. Stored as one JSON object per line so the
 * file is appendable without a re-write.
 */
export interface SkillTrustBypassEntry {
    /** ISO-8601 timestamp at the moment of bypass. */
    readonly timestamp: string;
    /** Skill name (basename of the scanned path). */
    readonly skillName: string;
    /** Original source identifier (URL, repo). */
    readonly source: string;
    /** Trust level resolved by the scanner. */
    readonly trustLevel: ScanResult['trustLevel'];
    /** Original verdict the scanner produced before override. */
    readonly verdict: ScanResult['verdict'];
    /** Number of findings present at bypass time. */
    readonly findingsCount: number;
    /** Optional operator-supplied justification. */
    readonly reason: string | null;
}
/**
 * Append a trust-bypass audit row.
 *
 * Idempotency note: the writer always appends — duplicate bypass calls
 * produce duplicate rows by design, since the operator may force-install
 * the same skill multiple times across the lifecycle.
 *
 * @param result - The scan result that was overridden.
 * @param reason - Optional operator-supplied justification.
 * @param cleoRoot - Optional `.cleo` directory override (test hook).
 * @returns The persisted entry (echo of what was written).
 *
 * @task T9730
 */
export declare function recordTrustBypass(result: ScanResult, reason?: string | null, cleoRoot?: string): SkillTrustBypassEntry;
/**
 * Resolve the audit-log path for callers that need to display the location
 * (e.g. CLI messages: "logged to <path>").
 *
 * @param cleoRoot - Optional `.cleo` directory override.
 */
export declare function getTrustBypassLogPath(cleoRoot?: string): string;
//# sourceMappingURL=skills-guard-audit.d.ts.map