import type { FsWatcher } from './fs-watcher.js';
export type Logger = (line: string) => void;
export interface AuditSession {
    sessionId: string;
    /** Sidecar role, or null for native rc-daemon operator sessions. */
    role: string | null;
    state: string;
    /** True when the JSONL contains an assistant tool_use whose name is not the
     *  auth tool. */
    usedRealTool: boolean;
}
export interface AuditOnceDeps {
    sessions: AuditSession[];
    hasState: (sessionId: string) => boolean;
    logger: Logger;
}
/** Pure reconciliation: emit one audit-orphan line per live native-operator
 *  session that used a real tool but has no auth-state file. */
export declare function auditOnce(deps: AuditOnceDeps): number;
export interface IdentityAuditDeps {
    watcher: FsWatcher;
    /** Account dir (the manager's spawnCwd); used to derive JSONL + state paths. */
    spawnCwd: string;
    /** Directory holding per-session auth-state files written by the gate hook. */
    stateDir: string;
    intervalMs: number;
    logger: Logger;
}
export interface IdentityAudit {
    start(): void;
    stop(): void;
    /** Run one audit pass synchronously. Exposed for tests. */
    tickOnce(): {
        scanned: number;
        orphans: number;
    };
}
export declare function createIdentityAudit(deps: IdentityAuditDeps): IdentityAudit;
//# sourceMappingURL=admin-identity-audit.d.ts.map