export interface AuditSessionLike {
    run(query: string, params?: Record<string, unknown>): Promise<{
        records: Array<{
            get(key: string): unknown;
        }>;
    }>;
}
/** The census-line suffix. A `-` (not empty) marks "no offenders" so the field
 *  is always present and greppable. */
export declare function formatRootlessSuffix(rootlessIds: string[]): string;
/** Given the client accountIds, return those lacking a :LocalBusiness OR an
 *  :AdminUser for that account (either missing ⇒ rootless). One round-trip.
 *  Empty input issues no query. */
export declare function auditRootlessClients(session: AuditSessionLike, clientIds: string[]): Promise<string[]>;
export interface RootlessCensusDeps {
    neo4jUri: string;
    neo4jUser: string;
    neo4jPassword: string;
    accountsRoot: string;
    logger: (line: string) => void;
}
/** Emit one census line: the base `op=census` counts plus the rootless suffix.
 *  Best-effort Neo4j — absent env or an unreachable/erroring read degrades the
 *  rootless field to `unavailable` and never throws. */
export declare function emitRootlessCensus(deps: RootlessCensusDeps): Promise<void>;
export interface RootlessAudit {
    start(): void;
    stop(): void;
}
/** Standing periodic audit. Unref'd interval so it never holds the process
 *  open; each tick re-emits the census best-effort. */
export declare function createRootlessAudit(deps: RootlessCensusDeps & {
    intervalMs: number;
}): RootlessAudit;
//# sourceMappingURL=rootless-client-audit.d.ts.map