export interface AuditEntryBase {
    ts: string;
    verb: string;
    tool: string;
    ok: boolean;
    session: string;
}
/**
 * AuditEntry is open: verb-specific extras (id, url, name, …) pass through
 * without type churn. See references/audit-log-format.md for known shapes.
 */
export type AuditEntry = AuditEntryBase & Record<string, unknown>;
/**
 * Returns the data directory for the given tool's audit log.
 * Respects LLODEV_PM_TASKS_LOG_DIR env override, then XDG_DATA_HOME,
 * then ~/.local/share. Final path: <base>/llodev/pm-tasks/<tool>.
 */
export declare function resolveDataDir(tool: string): string;
export interface AppendOpts {
    logPath: string;
}
/**
 * Appends one JSONL line to logPath.
 * - Ensures the parent directory exists.
 * - Uses POSIX append-mode (flag "a") for atomic sub-4KB writes.
 * NOTE: Lines exceeding PIPE_BUF (~4KB on Linux/macOS) are not chunked;
 * callers should keep entries compact. See audit-log-format.md § Concurrency.
 */
export declare function appendAuditEntry(entry: AuditEntry, opts: AppendOpts): Promise<void>;
export interface RotateOpts {
    logPath: string;
    maxSizeBytes?: number;
    maxAgeDays?: number;
    keep?: number;
}
export interface RotationResult {
    rotated: boolean;
    archive?: string;
    prunedEntries?: number;
    prunedArchives?: string[];
}
/**
 * Rotates the audit log:
 * 1. (Optional) Age-prune: rewrite log keeping only entries >= now - maxAgeDays.
 * 2. Size check: if < maxSizeBytes, return { rotated: false }.
 * 3. Rename current log → audit.log.YYYY-MM-DD-N.jsonl, gzip it, remove uncompressed.
 * 4. Touch a fresh empty logPath.
 * 5. Prune oldest gz archives beyond `keep`.
 */
export declare function rotateAuditLog(opts: RotateOpts): Promise<RotationResult>;
export interface QueryOpts {
    logPath: string;
    since?: string;
    tool?: string;
    verb?: string;
    includeArchives?: boolean;
}
/**
 * Streams JSONL entries from the audit log (and optionally gzipped archives).
 * Invalid lines are silently skipped.
 * If includeArchives is true, yields archive entries (oldest first) before live-log entries.
 */
export declare function queryAuditLog(opts: QueryOpts): AsyncIterable<AuditEntry>;
//# sourceMappingURL=audit.d.ts.map