/**
 * Component-internal mutation that appends one row to the audit log.
 * Declared as `internalMutation` because only `dispatch.runTool`
 * (inside this component) ever writes audit entries, hosts that
 * want to log custom audit events should wrap the public
 * `gateway.listAuditEntries` reader instead.
 */
export declare const recordEntry: import("convex/server").RegisteredMutation<"internal", {
    errorCode?: number | undefined;
    errorMessage?: string | undefined;
    outcome: "allowed" | "denied" | "error";
    toolName: string;
    args: any;
    durationMs: number;
    identitySubject: string | null;
    toolKind: "query" | "mutation" | "action";
}, Promise<import("convex/values").GenericId<"audit">>>;
/**
 * Append one resource-operation audit row. Unlike `recordEntry` (written by
 * the in-component `dispatch.runTool`), resource audit is recorded by the
 * host's HTTP handler, so this must be a public `mutation` exposed on the
 * component API, exactly like `dispatch.recordAuthDenial`. Resource contents
 * are intentionally never accepted here; callers store only operation
 * metadata such as URI, duration, outcome, and error summary.
 */
export declare const recordResourceEntry: import("convex/server").RegisteredMutation<"public", {
    resourceUri?: string | undefined;
    errorCode?: number | undefined;
    errorMessage?: string | undefined;
    outcome: "allowed" | "denied" | "error";
    args: any;
    durationMs: number;
    identitySubject: string | null;
    resourceOperation: "list" | "read" | "templates_list";
}, Promise<import("convex/values").GenericId<"audit">>>;
/**
 * List audit entries newest first, optionally filtered by tool name or
 * outcome. `limit` defaults to 100, capped at 1000 to keep the host from
 * pulling unbounded history through `runQuery`.
 *
 * When both `toolName` and `outcome` are supplied, the iteration walks
 * the `by_toolName` index ordered desc and stops once `limit` matching
 * entries are collected. A naive `take(limit*N)` + JS post-filter would
 * silently miss matches when most of the recent prefix doesn't match the
 * outcome (e.g. lots of recent `allowed` entries hiding older `error`s).
 */
export declare const listEntries: import("convex/server").RegisteredQuery<"public", {
    entryType?: "tool" | "resource" | "task" | undefined;
    limit?: number | undefined;
    outcome?: "allowed" | "denied" | "error" | undefined;
    resourceUri?: string | undefined;
    taskId?: string | undefined;
    toolName?: string | undefined;
}, Promise<{
    _id: import("convex/values").GenericId<"audit">;
    _creationTime: number;
    entryType?: "tool" | "resource" | "task" | undefined;
    resourceUri?: string | undefined;
    taskId?: string | undefined;
    toolName?: string | undefined;
    errorCode?: number | undefined;
    errorMessage?: string | undefined;
    resourceOperation?: "list" | "read" | "templates_list" | undefined;
    toolKind?: "query" | "mutation" | "action" | undefined;
    taskOperation?: "create" | "input" | "cancel" | "complete" | "fail" | undefined;
    outcome: "allowed" | "denied" | "error";
    args: any;
    durationMs: number;
    identitySubject: string | null;
}[]>>;
export declare const pruneOlderThan: import("convex/server").RegisteredMutation<"public", {
    cutoffMs: number;
}, Promise<number>>;
//# sourceMappingURL=audit.d.ts.map