import { SmrtCreateInput, SmrtObjectOptions, SmrtObject } from '@happyvertical/smrt-core';
/**
 * Secret audit action types
 */
export type SecretAuditAction = 'create' | 'read' | 'update' | 'delete' | 'rotate_key' | 'disable' | 'enable' | 'expire';
/**
 * Audit result types
 */
export type SecretAuditResult = 'success' | 'failure' | 'denied';
/**
 * Constructor options for {@link SecretAuditLog}. Each field is optional and
 * mirrors a persisted column.
 */
export interface SecretAuditLogOptions extends SmrtObjectOptions {
    tenantId?: string | null;
    secretId?: string | null;
    secretName?: string;
    userId?: string | null;
    action?: SecretAuditAction;
    result?: SecretAuditResult;
    ipAddress?: string;
    userAgent?: string;
    details?: Record<string, unknown>;
}
/**
 * SecretAuditLog records all operations on secrets for compliance
 * and security monitoring.
 *
 * Every secret operation (create, read, update, delete, key rotation)
 * is logged with the user, action, result, and relevant details.
 *
 * **Retention**: Audit logs should be retained according to your
 * compliance requirements (typically 1-7 years).
 *
 * @example
 * ```typescript
 * // Query recent audit logs
 * const logs = await auditLogs.list({
 *   where: { tenantId: 'tenant-123' },
 *   orderBy: 'created_at DESC',
 *   limit: 100
 * });
 *
 * // Filter by action
 * const reads = await auditLogs.list({
 *   where: {
 *     tenantId: 'tenant-123',
 *     action: 'read'
 *   }
 * });
 *
 * // Filter by secret name
 * const apiKeyLogs = await auditLogs.list({
 *   where: {
 *     tenantId: 'tenant-123',
 *     secretName: 'stripe-api-key'
 *   }
 * });
 * ```
 */
export declare class SecretAuditLog extends SmrtObject {
    /**
     * Tenant associated with the audited secret operation.
     */
    tenantId: string | null;
    /**
     * ID of the secret (may be null for deleted secrets)
     */
    secretId: string | null;
    /**
     * Name of the secret at the time of the operation
     */
    secretName: string;
    /**
     * ID of the user who performed the action, or `null` for system-initiated
     * operations with no authenticated user. Stored as a native `uuid` column on
     * Postgres, so a non-UUID actor sentinel must never reach it —
     * {@link createAuditEntry} normalizes the `'system'` sentinel to null (#1444).
     */
    userId: string | null;
    /**
     * The action that was performed
     */
    action: SecretAuditAction;
    /**
     * Result of the operation
     */
    result: SecretAuditResult;
    /**
     * IP address of the client (if available)
     */
    ipAddress: string;
    /**
     * User agent string (if available)
     */
    userAgent: string;
    /**
     * Additional context about the operation
     */
    details: Record<string, unknown>;
    constructor(options?: SecretAuditLogOptions);
    /**
     * Check if this was a successful operation
     */
    isSuccess(): boolean;
    /**
     * Check if this was a failed operation
     */
    isFailure(): boolean;
    /**
     * Check if this was a denied operation (permission denied)
     */
    isDenied(): boolean;
    /**
     * Check if this is a read operation
     */
    isReadAction(): boolean;
    /**
     * Check if this is a write operation (create, update, delete)
     */
    isWriteAction(): boolean;
    /**
     * Check if this is a key operation
     */
    isKeyOperation(): boolean;
}
/**
 * Create an audit log entry for a secret operation
 */
export declare function createAuditEntry(params: {
    secretId?: string | null;
    secretName: string;
    tenantId?: string | null;
    userId?: string | null;
    action: SecretAuditAction;
    result: SecretAuditResult;
    ipAddress?: string;
    userAgent?: string;
    details?: Record<string, unknown>;
}): SmrtCreateInput<SecretAuditLog>;
//# sourceMappingURL=SecretAuditLog.d.ts.map