//#region src/oauth/audit-emitter.d.ts
/**
 * Typed in-process event emitter for OAuth-subsystem audit events.
 * Mirrors the secrets-layer emitter so the audit-log subsystem can
 * subscribe via `bridgeOAuthToAudit(...)` and translate every event
 * into a tamper-evident chain entry.
 *
 * @packageDocumentation
 */
/**
 * Discriminator for `OAuthAuditEvent`. Variants follow the
 * `<resource>:<action>` convention used throughout the audit log.
 *
 * @stable
 */
type OAuthAuditAction = 'oauth:granted' | 'oauth:refreshed' | 'oauth:revoked' | 'oauth:registered' | 'oauth:expired';
/**
 * Discriminator for the outcome of a single audit event.
 *
 * @stable
 */
type OAuthAuditDecision = 'success' | 'denied' | 'error';
/**
 * Optional identifier of who initiated the event. Forwarded by the
 * library functions / CLI so the audit log records the correct
 * actor.
 *
 * @stable
 */
interface OAuthAuditActor {
  readonly kind: 'cli' | 'agent' | 'system' | 'tool' | 'subagent';
  readonly id?: string;
}
/**
 * One audit event. The payload is intentionally minimal - no token
 * material - only safe metadata (server identifier, scope, expiry,
 * registration kind).
 *
 * @stable
 */
interface OAuthAuditEvent {
  readonly action: OAuthAuditAction;
  readonly decision: OAuthAuditDecision;
  readonly ts: number;
  /** Stable identifier of the OAuth subsystem (always `'oauth'`). */
  readonly source: string;
  /** Target follows the convention `mcp:<server-id>` for MCP servers. */
  readonly target: string;
  readonly actor?: OAuthAuditActor;
  readonly metadata?: Readonly<Record<string, unknown>>;
}
/**
 * Callback shape accepted by {@link onOAuthAudit}.
 *
 * @stable
 */
type OAuthAuditListener = (event: OAuthAuditEvent) => void;
/**
 * Subscribe to OAuth-subsystem audit events. The audit-log subsystem
 * registers exactly one listener that forwards each event to the
 * audit database.
 *
 * @stable
 */
declare function onOAuthAudit(listener: OAuthAuditListener): () => void;
/**
 * Emit an event to every subscriber. Listeners that throw are
 * isolated - a faulty listener never tears down the OAuth fast
 * path.
 *
 * @stable
 */
declare function emitOAuthAudit(event: OAuthAuditEvent): void;
/**
 * Reset the listener set. Used by tests.
 *
 * @experimental
 */
declare function _resetOAuthAuditListenersForTesting(): void;
/**
 * Number of currently-registered listeners.
 *
 * @experimental
 */
declare function _getOAuthAuditListenerCountForTesting(): number;
//#endregion
export { OAuthAuditAction, OAuthAuditActor, OAuthAuditDecision, OAuthAuditEvent, OAuthAuditListener, _getOAuthAuditListenerCountForTesting, _resetOAuthAuditListenersForTesting, emitOAuthAudit, onOAuthAudit };
//# sourceMappingURL=audit-emitter.d.ts.map