export interface AuditSessionLike {
    run(query: string, params?: Record<string, unknown>): Promise<{
        records: Array<{
            get(key: string): unknown;
        }>;
    }>;
}
/** Invariant A violation: an AdminUser with no OWNS-Person to name it. */
export interface OrphanAdminUser {
    accountId: string;
    userId: string;
}
/** Invariant B violation: an owned Person carrying no givenName. */
export interface NamelessOwnedPerson {
    accountId: string;
    userId: string;
}
/** One alarm line per orphan AdminUser. Ids truncated to 8 for readability. */
export declare function formatOrphanAdminUserLine(f: OrphanAdminUser): string;
/** One alarm line per nameless owned Person. Ids truncated to 8. */
export declare function formatNamelessOwnedPersonLine(f: NamelessOwnedPerson): string;
export interface IdentityInvariantFindings {
    orphanAdminUsers: OrphanAdminUser[];
    namelessOwnedPersons: NamelessOwnedPerson[];
}
/** Read both invariant violations. Two round-trips: AdminUsers with no
 *  OWNS-Person (A), and owned Persons in the AdminUser's own account with no
 *  givenName (B). The account-independent keying (p.accountId = au.accountId)
 *  matches the canonical name resolver, so the audit flags exactly what the
 *  footer would fail to render. */
export declare function auditIdentityInvariants(session: AuditSessionLike): Promise<IdentityInvariantFindings>;
export interface IdentityAuditDeps {
    neo4jUri: string;
    neo4jUser: string;
    neo4jPassword: string;
    logger: (line: string) => void;
}
/** Run one audit pass and log an alarm line per violation. Best-effort Neo4j —
 *  absent env or an unreachable/erroring read logs op=unavailable and never
 *  throws. A clean pass logs one op=ok line so the audit's own liveness shows. */
export declare function emitIdentityAudit(deps: IdentityAuditDeps): Promise<void>;
export interface IdentityAudit {
    start(): void;
    stop(): void;
}
/** Standing periodic audit. Unref'd interval so it never holds the process open;
 *  each tick re-emits best-effort. */
export declare function createIdentityAudit(deps: IdentityAuditDeps & {
    intervalMs: number;
}): IdentityAudit;
//# sourceMappingURL=identity-audit.d.ts.map