import type Database from 'better-sqlite3';
export declare const AUDIT_MODE_ENV = "MEMENTO_AUDIT_MODE";
export type AuditTransport = 'mcp_stdio' | 'mcp_http' | 'http_admin';
export type AuditAction = 'read' | 'write' | 'delete' | 'admin' | 'auth_denied';
export type AuditResultStatus = 'success' | 'failure' | 'denied';
export type AuditEvidenceMode = 'full' | 'redacted' | 'metadata_only' | 'unavailable';
export type AuditPayloadState = 'captured' | 'redacted' | 'omitted';
export type AuditOutputState = 'captured' | 'truncated' | 'omitted';
export type AuditVerdict = 'pass' | 'fail' | 'incomplete';
export type AuditCoverageGap = 'audit_write_failed' | 'actor_unverified' | 'payload_redacted' | 'output_truncated' | 'retention_conflict';
export type AuditMode = 'best-effort' | 'strict';
export interface AuditLogInput {
    actorId?: string | null;
    ownerId?: string | null;
    agentId?: string | null;
    transport: AuditTransport;
    toolOrEndpoint: string;
    action: AuditAction;
    targetUri?: string | null;
    resultStatus: AuditResultStatus;
    evidenceMode?: AuditEvidenceMode;
    requestSeen?: boolean;
    responseSeen?: boolean;
    toolArgsState?: AuditPayloadState;
    outputState?: AuditOutputState;
    auditVerdict?: AuditVerdict;
    coverageGap?: AuditCoverageGap | null;
}
export interface AuditLogRecord extends Required<Omit<AuditLogInput, 'actorId' | 'ownerId' | 'agentId' | 'targetUri' | 'coverageGap'>> {
    id: string;
    timestamp: string;
    actorId: string | null;
    ownerId: string | null;
    agentId: string | null;
    targetUri: string | null;
    coverageGap: AuditCoverageGap | null;
    previousHash: string | null;
    currentHash: string;
}
export interface AuditLogQuery {
    action?: AuditAction;
    transport?: AuditTransport;
    actorId?: string;
    limit?: number;
}
export interface AuditChainVerification {
    valid: boolean;
    checked: number;
    brokenAtId?: string;
}
export declare class AuditCoverageError extends Error {
    constructor(message: string);
}
export declare function getAuditMode(): AuditMode;
export declare function isStrictAuditAction(action: AuditAction): boolean;
export declare function assertAuditCoverage(input: AuditLogInput): void;
export declare class AuditHashChainService {
    private readonly db;
    constructor(db: Database.Database);
    append(input: AuditLogInput): AuditLogRecord;
    list(query?: AuditLogQuery): AuditLogRecord[];
    verify(): AuditChainVerification;
}
//# sourceMappingURL=audit-hash-chain-service.d.ts.map