export declare function redactConfigAuditArgv(argv: readonly string[]): string[];
export declare function snapshotConfigAuditProcessInfo(): ConfigAuditProcessInfo;
export type ConfigWriteAuditResult = "rename" | "copy-fallback" | "failed" | "rejected";
type ConfigWriteAuditRecord = {
    ts: string;
    source: "config-io";
    event: "config.write";
    result: ConfigWriteAuditResult;
    configPath: string;
    pid: number;
    ppid: number;
    cwd: string;
    argv: string[];
    execArgv: string[];
    watchMode: boolean;
    watchSession: string | null;
    watchCommand: string | null;
    existsBefore: boolean;
    previousHash: string | null;
    nextHash: string | null;
    previousBytes: number | null;
    nextBytes: number | null;
    previousDev: string | null;
    nextDev: string | null;
    previousIno: string | null;
    nextIno: string | null;
    previousMode: number | null;
    nextMode: number | null;
    previousNlink: number | null;
    nextNlink: number | null;
    previousUid: number | null;
    nextUid: number | null;
    previousGid: number | null;
    nextGid: number | null;
    changedPathCount: number | null;
    hasMetaBefore: boolean;
    hasMetaAfter: boolean;
    gatewayModeBefore: string | null;
    gatewayModeAfter: string | null;
    suspicious: string[];
    errorCode?: string;
    errorMessage?: string;
};
export type ConfigObserveAuditRecord = {
    ts: string;
    source: "config-io";
    event: "config.observe";
    phase: "read";
    configPath: string;
    pid: number;
    ppid: number;
    cwd: string;
    argv: string[];
    execArgv: string[];
    exists: boolean;
    valid: boolean;
    hash: string | null;
    bytes: number | null;
    mtimeMs: number | null;
    ctimeMs: number | null;
    dev: string | null;
    ino: string | null;
    mode: number | null;
    nlink: number | null;
    uid: number | null;
    gid: number | null;
    hasMeta: boolean;
    gatewayMode: string | null;
    suspicious: string[];
    lastKnownGoodHash: string | null;
    lastKnownGoodBytes: number | null;
    lastKnownGoodMtimeMs: number | null;
    lastKnownGoodCtimeMs: number | null;
    lastKnownGoodDev: string | null;
    lastKnownGoodIno: string | null;
    lastKnownGoodMode: number | null;
    lastKnownGoodNlink: number | null;
    lastKnownGoodUid: number | null;
    lastKnownGoodGid: number | null;
    lastKnownGoodGatewayMode: string | null;
    backupHash: string | null;
    backupBytes: number | null;
    backupMtimeMs: number | null;
    backupCtimeMs: number | null;
    backupDev: string | null;
    backupIno: string | null;
    backupMode: number | null;
    backupNlink: number | null;
    backupUid: number | null;
    backupGid: number | null;
    backupGatewayMode: string | null;
    clobberedPath: string | null;
    restoredFromBackup: boolean;
    restoredBackupPath: string | null;
    restoreErrorCode: string | null;
    restoreErrorMessage: string | null;
};
type ConfigAuditRecord = ConfigWriteAuditRecord | ConfigObserveAuditRecord;
type ConfigAuditStatMetadata = {
    dev: string | null;
    ino: string | null;
    mode: number | null;
    nlink: number | null;
    uid: number | null;
    gid: number | null;
};
type ConfigAuditProcessInfo = {
    pid: number;
    ppid: number;
    cwd: string;
    argv: string[];
    execArgv: string[];
};
type ConfigWriteAuditRecordBase = Omit<ConfigWriteAuditRecord, "result" | "nextDev" | "nextIno" | "nextMode" | "nextNlink" | "nextUid" | "nextGid" | "errorCode" | "errorMessage"> & {
    nextHash: string;
    nextBytes: number;
};
type ConfigAuditFs = {
    promises: {
        mkdir(path: string, options?: {
            recursive?: boolean;
            mode?: number;
        }): Promise<unknown>;
        appendFile(path: string, data: string, options?: {
            encoding?: BufferEncoding;
            mode?: number;
        }): Promise<unknown>;
    };
    mkdirSync(path: string, options?: {
        recursive?: boolean;
        mode?: number;
    }): unknown;
    appendFileSync(path: string, data: string, options?: {
        encoding?: BufferEncoding;
        mode?: number;
    }): unknown;
};
export declare function resolveConfigAuditLogPath(env: NodeJS.ProcessEnv, homedir: () => string): string;
export declare function formatConfigOverwriteLogMessage(params: {
    configPath: string;
    previousHash: string | null;
    nextHash: string;
    changedPathCount?: number;
}): string;
export declare function createConfigWriteAuditRecordBase(params: {
    configPath: string;
    env: NodeJS.ProcessEnv;
    existsBefore: boolean;
    previousHash: string | null;
    nextHash: string;
    previousBytes: number | null;
    nextBytes: number;
    previousMetadata: ConfigAuditStatMetadata;
    changedPathCount: number | null | undefined;
    hasMetaBefore: boolean;
    hasMetaAfter: boolean;
    gatewayModeBefore: string | null;
    gatewayModeAfter: string | null;
    suspicious: string[];
    now?: string;
    processInfo?: ConfigAuditProcessInfo;
}): ConfigWriteAuditRecordBase;
export declare function finalizeConfigWriteAuditRecord(params: {
    base: ConfigWriteAuditRecordBase;
    result: ConfigWriteAuditResult;
    nextMetadata?: ConfigAuditStatMetadata | null;
    err?: unknown;
}): ConfigWriteAuditRecord;
type ConfigAuditAppendContext = {
    fs: ConfigAuditFs;
    env: NodeJS.ProcessEnv;
    homedir: () => string;
};
type ConfigAuditAppendParams = ConfigAuditAppendContext & ({
    record: ConfigAuditRecord;
} | ConfigAuditRecord);
export declare function appendConfigAuditRecord(params: ConfigAuditAppendParams): Promise<void>;
export declare function appendConfigAuditRecordSync(params: ConfigAuditAppendParams): void;
export {};