/**
 * Audit log SSE stream route.
 *
 * The two list-reads (`audit_log_list`, `audit_log_role_grant_history`) moved to
 * RPC in `auth/admin_actions.ts`, and the admin session listing moved to
 * `admin_session_list` on the same file. What remains here is the optional
 * `GET /audit/stream` SSE route — streams aren't an action-kind, so they
 * stay on REST. The event payload broadcast on the stream surfaces via
 * `audit_log_event_specs` (one `EventSpec` per audit event type) declared
 * alongside the broadcaster in `realtime/sse_auth_guard.ts`.
 *
 * @module
 */
import type { Logger } from '@fuzdev/fuz_util/log.js';
import type { RouteSpec } from '../http/route_spec.js';
import { type SseStream, type SseNotification } from '../realtime/sse.js';
import type { SubscribeOptions } from '../realtime/subscriber_registry.js';
/** Options for audit log route specs. */
export interface AuditLogRouteOptions {
    /** Role required to access audit routes. Default `'admin'`. */
    required_role?: string;
    /**
     * When provided, includes an SSE route at `/audit/stream` for realtime audit events.
     * The `subscribe` function receives the stream, channels, and the subscriber's `account_id`
     * as an identity key — enabling `close_by_identity()` for auth revocation.
     */
    stream?: {
        subscribe: (stream: SseStream<SseNotification>, options?: SubscribeOptions) => () => void;
        log: Logger;
    };
}
/**
 * Create the optional audit-log SSE route spec.
 *
 * Returns an empty array when `options.stream` is not set — no REST routes
 * live here apart from the stream.
 *
 * @param options - optional stream wiring + role override
 * @returns the SSE route spec (when `options.stream` is provided) or an empty array
 */
export declare const create_audit_log_route_specs: (options?: AuditLogRouteOptions) => Array<RouteSpec>;
//# sourceMappingURL=audit_log_routes.d.ts.map