/**
 * Audit Log
 *
 * Independent audit log stream for security-sensitive events:
 * - Authentication events (login, logout, token refresh)
 * - Configuration changes
 * - Permission changes
 * - Data access events
 */
export type AuditEventType = 'auth.login' | 'auth.logout' | 'auth.token_refresh' | 'auth.failed' | 'config.update' | 'config.reload' | 'permission.grant' | 'permission.revoke' | 'data.access' | 'data.export' | 'data.delete' | 'admin.action';
export interface AuditEvent {
    id: string;
    timestamp: string;
    type: AuditEventType;
    actor: {
        userId?: string;
        sessionId?: string;
        ip?: string;
        userAgent?: string;
    };
    resource: {
        type: string;
        id?: string;
        path?: string;
    };
    action: {
        type: string;
        result: 'success' | 'failure' | 'denied';
        details?: Record<string, unknown>;
    };
    metadata?: {
        requestId?: string;
        location?: string;
        reason?: string;
    };
}
export interface AuditLogConfig {
    enabled: boolean;
    logDir?: string;
    retentionDays?: number;
    logToConsole?: boolean;
    sensitiveFields?: string[];
}
export declare function configureAuditLog(config: Partial<AuditLogConfig>): void;
export declare function getAuditConfig(): AuditLogConfig;
export declare function logAuditEvent(type: AuditEventType, params: {
    actor?: AuditEvent['actor'];
    resource: AuditEvent['resource'];
    action: Omit<AuditEvent['action'], 'result'> & {
        result?: AuditEvent['action']['result'];
    };
    metadata?: AuditEvent['metadata'];
}): Promise<AuditEvent>;
export declare function logAuthEvent(type: 'auth.login' | 'auth.logout' | 'auth.token_refresh' | 'auth.failed', params: {
    userId?: string;
    sessionId?: string;
    ip?: string;
    userAgent?: string;
    result: 'success' | 'failure' | 'denied';
    reason?: string;
}): Promise<AuditEvent>;
export declare function logConfigChange(params: {
    userId?: string;
    section: string;
    path: string;
    oldValue?: unknown;
    newValue?: unknown;
    result: 'success' | 'failure';
}): Promise<AuditEvent>;
export declare function logPermissionChange(params: {
    userId?: string;
    targetUserId: string;
    action: 'grant' | 'revoke';
    permission: string;
    resourceType: string;
    resourceId?: string;
    result: 'success' | 'failure';
}): Promise<AuditEvent>;
export declare function logDataAccess(params: {
    userId?: string;
    sessionId?: string;
    action: 'read' | 'write' | 'delete' | 'export';
    resourceType: string;
    resourceId?: string;
    path?: string;
    result: 'success' | 'failure' | 'denied';
    metadata?: Record<string, unknown>;
}): Promise<AuditEvent>;