//#region src/auth/audit-emitter.d.ts
/**
 * Typed in-process event emitter for server-token auth events.
 * The audit-log subsystem subscribes via {@link bridgeAuthToAudit} to
 * write these into the dedicated audit database - the auth layer never
 * reaches across the package boundary to write rows itself, mirroring
 * the secrets / oauth / supply-chain bridges.
 *
 * @packageDocumentation
 */
/**
 * Discriminator for `AuthAuditEvent`. The `token:*` actions cover the
 * CRUD lifecycle; `auth:granted` / `auth:denied:*` cover verification
 * outcomes.
 *
 * @stable
 */
type AuthAuditAction = 'token:create' | 'token:revoke' | 'token:rotate' | 'token:rekey' | 'auth:granted' | 'auth:denied:unauth' | 'auth:denied:scope' | 'auth:denied:lockout';
/** Outcome of a single auth audit event. @stable */
type AuthAuditDecision = 'success' | 'denied' | 'error';
/** Optional pointer to who initiated the event. @stable */
interface AuthAuditActor {
  readonly kind: 'cli' | 'agent' | 'tool' | 'system' | 'subagent' | 'token';
  readonly id?: string;
  readonly runId?: string;
  readonly sessionId?: string;
}
/**
 * One auth audit event. The payload never carries the raw token or the
 * pepper - only the token id / metadata safe to log.
 *
 * @stable
 */
interface AuthAuditEvent {
  readonly action: AuthAuditAction;
  readonly decision: AuthAuditDecision;
  readonly ts: number;
  /** Token id (`token:*`) or the failure subject (`auth:denied:*`). */
  readonly target: string;
  readonly actor?: AuthAuditActor;
  /** Bounded, secret-free context (scopes, ip, reason). */
  readonly metadata?: Readonly<Record<string, unknown>>;
}
/** Listener signature. @stable */
type AuthAuditListener = (event: AuthAuditEvent) => void;
/**
 * Subscribe to auth audit events. Returns an unsubscribe function.
 *
 * @stable
 */
declare function onAuthAudit(listener: AuthAuditListener): () => void;
/**
 * Reset the listener set. Used by tests.
 *
 * @experimental
 */
declare function _resetAuthAuditListenersForTesting(): void;
/** @experimental - test seam to assert wiring. */
declare function _getAuthAuditListenerCountForTesting(): number;
/**
 * Emit an auth audit event to every subscriber. Listener exceptions are
 * isolated from the auth path.
 *
 * @stable
 */
declare function emitAuthAudit(event: AuthAuditEvent): void;
//#endregion
export { AuthAuditAction, AuthAuditActor, AuthAuditDecision, AuthAuditEvent, AuthAuditListener, _getAuthAuditListenerCountForTesting, _resetAuthAuditListenersForTesting, emitAuthAudit, onAuthAudit };
//# sourceMappingURL=audit-emitter.d.ts.map