import type { FrontMcpLogger } from '../common';
import type { SkillsConfigAuditOptions } from '../common/types/options/skills-http/interfaces';
import type ProviderRegistry from '../provider/provider.registry';
/**
 * Minimal structural shape we need from the audit module. Defined locally so
 * the SDK doesn't take a hard dependency on `@frontmcp/adapters/skills`.
 *
 * Hosts that don't have the adapters package installed will hit a clear
 * runtime error if they enable audit without injecting a factory — we do NOT
 * silently skip audit registration, because that would mask a security
 * configuration error.
 */
/**
 * Loosely-typed options bag forwarded to `new SkillAuditWriter(...)`. Mirrors
 * `SkillAuditWriterOptions` in `@frontmcp/adapters/skills` but kept structural
 * here so the SDK doesn't take an upward dependency.
 */
export interface AuditWriterOptionsShape {
    subjectMode?: 'plain' | 'hash' | 'omit';
    subjectHashSecret?: Uint8Array;
    maxQueueDepth?: number;
}
export interface AuditModuleShape {
    SkillAuditWriterToken: symbol;
    SkillAuditWriter: new (store: unknown, signer: unknown, logger: FrontMcpLogger, metrics?: unknown, options?: AuditWriterOptionsShape) => unknown;
    Hs256AuditSigner: new (secret: string | Uint8Array, keyId: string) => unknown;
    MemoryAuditStore: new () => unknown;
}
/**
 * Factory that returns the audit module. Set once at host bootstrap with
 * {@link setSkillAuditFactory} so the SDK can resolve the module without
 * `eval`/`require` and without taking a hard dependency on the adapters
 * package. This is the Edge-runtime-safe replacement for the previous
 * `eval('require')` shim.
 *
 * @example
 * ```ts
 * import { setSkillAuditFactory } from '@frontmcp/sdk';
 * import * as auditModule from '@frontmcp/adapters/skills';
 *
 * setSkillAuditFactory(() => auditModule);
 * ```
 */
export type SkillAuditFactory = () => AuditModuleShape;
/**
 * Register the host-side factory that resolves the audit module. Call once
 * at boot (e.g. in your bootstrap file) before the FrontMCP scope is built.
 *
 * Pass `undefined` to clear the factory (used by tests).
 */
export declare function setSkillAuditFactory(factory: SkillAuditFactory | undefined): void;
/**
 * Register the SkillAuditWriter in the scope DI container when
 * `skillsConfig.audit.enabled` is set.
 *
 * Defaults (used only when the host doesn't supply explicit signer/store):
 *   - signer: in-memory HS256 with a randomly generated 32-byte secret
 *     (refused in production — host MUST configure an explicit signer).
 *   - store: in-memory append-only log
 *
 * Both defaults are flagged in the logs as dev-only so production hosts
 * don't accidentally rely on them.
 */
export declare function registerSkillAuditWriter(options: {
    providers: ProviderRegistry;
    audit: SkillsConfigAuditOptions | undefined;
    logger: FrontMcpLogger;
}): void;
//# sourceMappingURL=skill-audit.helper.d.ts.map