/**
 * Audit log database queries.
 *
 * Records and retrieves auth mutation events for security monitoring. The
 * canonical fire-and-forget entry point is `AppDeps.audit.emit(ctx, input)`
 * (see `auth/audit_emitter.ts`) — it closes over the pool so audit rows
 * persist even when the request transaction rolls back. This module only
 * exposes the in-transaction `query_*` primitives and the drift counters;
 * the bound emitter writes through `query_audit_log` against its captured
 * pool.
 *
 * @module
 */
import type { QueryDeps } from '../db/query_deps.js';
import { type AuditLogConfig, type AuditLogEvent, type AuditLogInput, type AuditLogListOptions, type AuditLogEventWithUsernamesJson, type RoleGrantHistoryEventJson } from './audit_log_schema.js';
/** Number of audit metadata validation failures observed since process start. */
export declare const get_audit_metadata_validation_failures: () => number;
/** Reset the counter — for tests only. */
export declare const reset_audit_metadata_validation_failures: () => void;
/** Number of audit unknown-event-type failures observed since process start. */
export declare const get_audit_unknown_event_type_failures: () => number;
/** Reset the counter — for tests only. */
export declare const reset_audit_unknown_event_type_failures: () => void;
/**
 * Insert an audit log entry.
 *
 * `RETURNING *` so callers receive DB-assigned fields (`id`, `seq`,
 * `created_at`). Validates `metadata` against `config.metadata_schemas`;
 * unknown `event_type` and metadata mismatches log + bump their counters
 * but write the row anyway. Consumers extend the recognized set via
 * `create_audit_log_config({extra_events})`.
 *
 * In-transaction call site for query helpers that must atomically write the
 * row alongside other mutations (e.g. `query_accept_offer`). Fire-and-forget
 * call sites should reach for `AppDeps.audit.emit` instead — that wrapper
 * closes over the pool so audit rows persist when the parent transaction
 * rolls back.
 *
 * @param deps - query dependencies
 * @param input - the audit event to record
 * @param config - audit-log config. Defaults to `builtin_audit_log_config`.
 * @returns the inserted audit log row
 * @mutates `audit_log` table - inserts the new row
 * @mutates drift counters - bumps `audit_unknown_event_type_failures` and/or `audit_metadata_validation_failures` on mismatch
 */
export declare const query_audit_log: <T extends string>(deps: QueryDeps, input: AuditLogInput<T>, config?: AuditLogConfig) => Promise<AuditLogEvent>;
/**
 * List audit log entries, newest first.
 *
 * @param deps - query dependencies
 * @param options - filters and pagination
 * @returns matching audit log entries
 */
export declare const query_audit_log_list: (deps: QueryDeps, options?: AuditLogListOptions) => Promise<Array<AuditLogEvent>>;
/**
 * List audit log entries with resolved usernames, newest first.
 *
 * @param deps - query dependencies
 * @param options - filters and pagination
 * @returns matching audit log entries with `username` and `target_username`
 */
export declare const query_audit_log_list_with_usernames: (deps: QueryDeps, options?: AuditLogListOptions) => Promise<Array<AuditLogEventWithUsernamesJson>>;
/**
 * List role_grant grant/revoke events with resolved usernames.
 *
 * @param deps - query dependencies
 * @param limit - maximum entries to return
 * @param offset - number of entries to skip
 * @returns role_grant history events with `username` and `target_username`
 */
export declare const query_audit_log_list_role_grant_history: (deps: QueryDeps, limit?: number, offset?: number) => Promise<Array<RoleGrantHistoryEventJson>>;
/**
 * Delete audit log entries older than the given date.
 *
 * @param deps - query dependencies
 * @param before - delete entries created before this date
 * @returns the number of entries deleted
 * @mutates `audit_log` table - deletes every row with `created_at < before`
 */
export declare const query_audit_log_cleanup_before: (deps: QueryDeps, before: Date) => Promise<number>;
//# sourceMappingURL=audit_log_queries.d.ts.map