/**
 * Append-only permission audit log for swarm subagents (dream-cycle #2768).
 *
 * Every grant / check / deny / revoke event is written to
 * `.swarm/permission-audit.jsonl` — one JSON object per line, no rewrites,
 * no deletes. Persistence follows the same discipline as ruflo's other
 * append-only ledgers (routing-outcomes, funnel-events) so downstream
 * readers can tail without truncation risk.
 */
/** A single permission-audit event. */
export interface AuditEvent {
    /** ISO-8601 timestamp. */
    timestamp: string;
    /** Opaque agent identifier — matches Task tool `name:` or a swarm-assigned slot id. */
    agentId: string;
    /** Symbolic role — matches PermissionSet.role. */
    role: string;
    /** Event class. */
    event: 'granted' | 'checked' | 'denied' | 'revoked';
    /** Free-form capability descriptor (`tool:Bash`, `path:src/**`, `net:api.github.com`). */
    capability: string;
    /** Optional swarm-scope identifier. */
    swarmId?: string;
    /** Optional human-readable reason. */
    reason?: string;
    /** Auto-generated event id for correlation. */
    eventId: string;
}
/** Resolve `.swarm/permission-audit.jsonl` under the given (or cwd's) swarm dir. */
export declare function auditLogPath(swarmDir?: string): string;
/** Resolve `.swarm/permissions.jsonl` — the current-grants manifest. */
export declare function grantsPath(swarmDir?: string): string;
/** Append a single audit event. Never throws — failures are non-critical. */
export declare function appendAuditEvent(event: Omit<AuditEvent, 'eventId' | 'timestamp'>, swarmDir?: string): void;
/** Read every audit event. Used by review tooling. */
export declare function readAuditLog(swarmDir?: string): AuditEvent[];
/** Write the current grants manifest (overwrites) — one line per role. */
export declare function writeGrants(grants: unknown[], swarmDir?: string): void;
/** Read the current grants manifest. */
export declare function readGrants(swarmDir?: string): unknown[];
//# sourceMappingURL=permission-audit.d.ts.map