import { AuditDb } from "./audit-db.js";
import { SecretsAuditEvent } from "../secrets/audit-emitter.js";

//#region src/audit/secrets-bridge.d.ts

/**
 * Subscribe the audit-log subsystem to the secrets-layer event
 * emitter. Returns a teardown function that detaches the listener.
 *
 * Failures inside the bridge never propagate - the audit subsystem
 * cannot tear down the secret-access path.
 *
 * @stable
 */
interface BridgeSecretsToAuditOptions {
  /** Audit database the bridge writes into. */
  readonly db: AuditDb;
  /** Optional logger called when a write fails. */
  readonly onWriteError?: (event: SecretsAuditEvent, error: unknown) => void;
}
/**
 * Teardown function returned by `bridgeSecretsToAudit(...)`.
 *
 * Calling it detaches the listener; the `.drain()` helper resolves
 * once every queued audit-log write has settled so test suites and
 * graceful-shutdown paths can wait for the bridge to finish before
 * closing the audit database.
 *
 * @stable
 */
interface SecretsBridgeTeardown {
  (): void;
  readonly drain: () => Promise<void>;
}
/**
 * Subscribe the audit-log subsystem to the secrets-layer audit
 * emitter. Returns a teardown function.
 *
 * Writes are serialised through a per-bridge queue (and also at the
 * source inside `appendAudit`, which serialises every
 * caller of one `AuditDb`) so concurrent secrets events never race on
 * `db.latest()` and produce duplicate `seq` values. A failed write is
 * isolated from the secret access path via the `onWriteError` callback;
 * when none is supplied it is logged (never swallowed) so a dropped
 * audit entry stays visible.
 *
 * @stable
 */
declare function bridgeSecretsToAudit(options: BridgeSecretsToAuditOptions): SecretsBridgeTeardown;
//#endregion
export { BridgeSecretsToAuditOptions, SecretsBridgeTeardown, bridgeSecretsToAudit };
//# sourceMappingURL=secrets-bridge.d.ts.map