/**
 * The daemon log-sink fan-out — the trust boundary where a log record is
 * written FULL-FIDELITY to the local dashboard DB but only a REDACTED copy is
 * forwarded to remote shippers (syslog / OTLP). Extracted from `lifecycle.ts`
 * so this privacy-critical path is unit-testable (review: "remote log redaction
 * wiring is not verified"): a regression that pushed the raw `entry` to a remote
 * shipper, or skipped redaction, would leak secrets off-node.
 */
import type { LogRecord } from '@origintrail-official/dkg-core';
/** Minimal shape of a remote log shipper (LogPushWorker / OtlpLogWorker). */
export interface RemoteLogShipper {
    push: (record: LogRecord) => void;
}
export interface DaemonLogSinkDeps {
    /** Persist the FULL (un-redacted) record to the local dashboard DB. */
    insertLog: (rec: {
        ts: number;
        level: string;
        operation_name?: string | null;
        operation_id?: string | null;
        module: string;
        message: string;
    }) => void;
    /** Redactor applied to the copy that leaves the node. */
    redact: (record: LogRecord) => LogRecord;
    /**
     * The CURRENT set of active remote shippers, evaluated per record so the sink
     * reflects runtime start/stop without re-wiring. `null`/`undefined` entries
     * (a disabled exporter) are skipped.
     */
    remoteShippers: () => Array<RemoteLogShipper | null | undefined>;
    /** Clock, injectable for tests. Defaults to Date.now. */
    now?: () => number;
}
/**
 * Build the `Logger.setSink` callback. Always stores the original locally
 * (errors swallowed — a DB write must never break the node); forwards exactly
 * ONE redacted copy to each active remote shipper, and nothing remote when none
 * are active.
 */
export declare function createDaemonLogSink(deps: DaemonLogSinkDeps): (entry: LogRecord) => void;
//# sourceMappingURL=log-sink.d.ts.map