/**
 * Aegis Metrics — Prometheus instrumentation via prom-client.
 *
 * Provides counters, histograms, and gauges for all Aegis request activity.
 * Metrics are exposed via a `/metrics` endpoint on the Gate server and are
 * compatible with Prometheus scraping and Grafana dashboards.
 *
 * Design:
 *   - Single shared `Registry` so Gate and MCP can share the same counters
 *   - Callers use the helper functions (`recordRequest`, `recordBlocked`, etc.)
 *     rather than touching prom-client directly
 *   - `collectCredentialGauges()` is called on each `/metrics` scrape to snapshot
 *     credential inventory from the Vault (it's a pull-model gauge, not push)
 *   - All metric names use the `aegis_` prefix per Prometheus naming conventions
 */
import { Counter, Gauge, Histogram, type Registry } from 'prom-client';
import type { Vault } from '../vault/index.js';
export interface MetricsOptions {
    /** Custom prom-client registry (default: global). Useful for tests. */
    registry?: Registry;
    /** Vault instance — needed for credential gauge collection. */
    vault?: Vault;
    /** Default labels applied to every metric (e.g. `{ instance: 'prod-1' }`). */
    defaultLabels?: Record<string, string>;
}
export type BlockReason = 'no_credential' | 'credential_expired' | 'credential_scope' | 'agent_auth_missing' | 'agent_auth_invalid' | 'agent_scope' | 'policy_violation' | 'policy_rate_limit' | 'agent_rate_limit' | 'credential_rate_limit' | 'domain_guard' | 'body_inspection' | 'body_too_large' | 'agent_connection_limit';
/**
 * Central metrics collector for Aegis.
 *
 * Usage:
 * ```ts
 * const metrics = new AegisMetrics({ vault });
 * // On every proxied request:
 * metrics.recordRequest('slack', 'GET', 200, 'my-agent');
 * // On every blocked request:
 * metrics.recordBlocked('slack', 'domain_guard', 'my-agent');
 * // Duration is measured with a timer:
 * const end = metrics.startRequestTimer('slack');
 * // ...do work...
 * end(); // records duration
 * ```
 */
export declare class AegisMetrics {
    readonly registry: Registry;
    private vault?;
    /** Total requests processed (allowed through to upstream). */
    readonly requestsTotal: Counter;
    /** Total requests blocked before reaching upstream. */
    readonly requestsBlockedTotal: Counter;
    /** Request duration in seconds (only for successful proxied requests). */
    readonly requestDuration: Histogram;
    /** Credential inventory by status. */
    readonly credentialsTotal: Gauge;
    constructor(options?: MetricsOptions);
    /**
     * Record a successfully proxied request.
     */
    recordRequest(service: string, method: string, status: number, agent?: string): void;
    /**
     * Record a blocked request.
     */
    recordBlocked(service: string, reason: BlockReason, agent?: string): void;
    /**
     * Start a request duration timer. Call the returned function when the request completes.
     *
     * @returns A stop function that records the elapsed time.
     */
    startRequestTimer(service: string): () => void;
    /**
     * Snapshot credential inventory from the Vault and update gauge values.
     * Called automatically on each `/metrics` scrape via the gauge's collect callback.
     */
    private collectCredentialGauges;
    /**
     * Return the Prometheus-formatted metrics string for scraping.
     * Used by the `/_aegis/metrics` endpoint handler.
     */
    getMetricsOutput(): Promise<string>;
    /**
     * Return the content-type header for the metrics response.
     */
    getContentType(): string;
    /**
     * Reset all metrics. Useful for tests.
     */
    reset(): void;
}
//# sourceMappingURL=metrics.d.ts.map