import type Database from 'better-sqlite3';
export interface AuditRecord {
    traceId: string;
    userId: string;
    platform: string;
    agent: string;
    intent: string;
    promptLen: number;
    responseLen: number;
    durationMs: number;
    cost: number;
    success: boolean;
    error?: string;
}
export declare function logInvocation(rec: AuditRecord): void;
export interface QueryOpts {
    limit?: number;
    agent?: string;
    platform?: string;
    userId?: string;
    intent?: string;
    days?: number;
    /** v1.2.111 — filter to one trace's rows. Supports exact match by
     *  default; pass `tracePrefix` instead for child-trace inclusion
     *  (e.g. parent + every `parent/a2a-*` descendant from A2A fan-outs). */
    traceId?: string;
    tracePrefix?: string;
}
export interface InvocationRow {
    id: number;
    trace_id: string;
    ts: string;
    user_id: string;
    platform: string;
    agent: string;
    intent: string;
    prompt_len: number;
    response_len: number;
    duration_ms: number;
    cost: number;
    success: number;
    error: string | null;
}
export declare function queryInvocations(opts?: QueryOpts): InvocationRow[];
/**
 * Delete rows older than the retention window. Returns number of deleted
 * rows so callers / tests can assert behavior.
 */
export declare function pruneExpired(d?: Database.Database | null): number;
export type AuditEventType = 'approval.allow' | 'approval.deny' | 'admin.elevate' | 'admin.revoke' | 'config.put' | 'env.put' | 'token.create' | 'token.revoke' | 'workspace.add' | 'workspace.delete' | 'notification.suppress';
export interface AuditEvent {
    traceId?: string;
    eventType: AuditEventType;
    actor: string;
    target?: string;
    outcome?: 'ok' | 'denied' | 'error';
    details?: Record<string, unknown>;
}
export interface AuditEventRow {
    id: number;
    ts: string;
    trace_id: string;
    event_type: string;
    actor: string;
    target: string;
    outcome: string;
    details: string;
}
export declare function logAuditEvent(ev: AuditEvent): void;
export interface AuditEventQueryOpts {
    types?: AuditEventType[];
    actor?: string;
    days?: number;
    limit?: number;
}
export declare function queryAuditEvents(opts?: AuditEventQueryOpts): AuditEventRow[];
export declare function pruneExpiredEvents(d?: Database.Database | null): number;
/** Stop the periodic retention sweep (used by tests and graceful shutdown). */
export declare function stopRetentionSweep(): void;
/** Close the underlying SQLite handle. Pairs with stopRetentionSweep on
 *  graceful shutdown so WAL is checkpointed cleanly (L2). */
export declare function closeAuditDb(): void;
/**
 * Top-line metrics for a recent window: total calls, total cost, error
 * rate, average + p95 latency. Used by /api/health/summary's KPI cards.
 */
export interface HealthSummary {
    since: string;
    until: string;
    days: number;
    totals: {
        calls: number;
        cost: number;
        errors: number;
        errorRate: number;
        avgLatencyMs: number;
        p95LatencyMs: number;
    };
    byDay: Array<{
        date: string;
        calls: number;
        cost: number;
        errors: number;
        avgLatencyMs: number;
    }>;
}
export declare function getHealthSummary(days: number): HealthSummary;
export type TopNDim = 'user' | 'agent' | 'platform' | 'intent';
export type TopNMetric = 'cost' | 'calls' | 'errors' | 'avg_latency';
export interface TopNItem {
    key: string;
    calls: number;
    cost: number;
    errors: number;
    avgLatencyMs: number;
}
/**
 * Top-N grouped by `dim`, sorted by `metric` desc. Used to surface
 * "which users / agents / platforms drove the most cost / errors".
 */
export declare function getTopN(dim: TopNDim, metric: TopNMetric, days: number, limit?: number): TopNItem[];
export declare function getStats(): {
    total: number;
    byAgent: Record<string, number>;
    totalCost: number;
};
//# sourceMappingURL=audit-log.d.ts.map