/**
 * Read-through helper for `access_log` (Orchestrator) — Phase D.
 *
 * Unlike `audit_log` and `secret_audit_log`, the `access_log` callers
 * (dashboard "Data access" tab, admin HTTP route, `kici-admin
 * access-log list` CLI) all use the same cursor-based pagination
 * already implemented by `AccessLogWriter.query()`. Phase D's design
 * §7 row 11 classifies access_log as "paginated/transparent" — there
 * is NO `--include-archived` flag. The helper merges cold rows
 * automatically when pagination crosses the warm cutoff or the caller
 * supplies a `from` timestamp older than warm.
 *
 * Cursor extension: the existing cursor encodes `{createdAt, id}` for
 * the hot tuple comparison `(created_at, id) < (cursor.createdAt, cursor.id)`.
 * The cursor also carries a `source: 'hot' | 'cold'` discriminator so a
 * cursor minted while the page boundary was inside cold can resume in
 * the cold stream on the next request. Cursors without a `source` field
 * default to `'hot'` — backwards-compatible with any tab the user had
 * open across a deploy boundary.
 */
import { type Kysely, type Selectable } from 'kysely';
import { type ColdStore } from '@kici-dev/shared';
import { type AccessLogAction, type AccessLogItem, type AccessLogOutcome, type AccessLogSource, type AccessLogTargetType, type ActorType } from '@kici-dev/engine';
import type { AccessLogTable, Database } from '../db/types.js';
/**
 * Synthetic tenant placeholder for orchestrator-level rows whose `org_id IS
 * NULL` — collapses every NULL-tenant row under one cold-store prefix so the
 * `(tenant_id, day)` partition scheme still yields a single scan key. Shared
 * across every cold-store reader / adapter touching tables that may emit
 * NULL-tenant rows (`access_log`, `secret_audit_log`); export once here so
 * the four call sites in `cold-store/` and the fallback in
 * `audit/access-log.ts` cannot drift apart.
 */
export declare const SYNTHETIC_ORCH_TENANT = "__orchestrator__";
export type AccessLogColdRow = Selectable<AccessLogTable>;
export interface LoadAccessLogRangeArgs {
    db: Kysely<Database>;
    coldStore: ColdStore | undefined;
    filter: {
        orgId?: string;
        actorType?: ActorType;
        actorId?: string;
        action?: AccessLogAction;
        source?: AccessLogSource;
        outcome?: AccessLogOutcome;
        targetType?: AccessLogTargetType;
        targetId?: string;
        fromTimestamp?: Date | string;
        toTimestamp?: Date | string;
        /**
         * Full-text search over `error_message`. Trigram-indexed via migration
         * `009_access_log_trigram.ts`. Min ~3 chars for the index to help.
         */
        q?: string;
    };
    limit: number;
    cursor?: string;
}
export interface LoadAccessLogRangeResult {
    items: AccessLogItem[];
    nextCursor: string | null;
}
export declare function loadAccessLogRange(args: LoadAccessLogRangeArgs): Promise<LoadAccessLogRangeResult>;
/**
 * Canonical hot-or-cold `AccessLogRow → AccessLogItem` adapter. Exported
 * because `AccessLogWriter.getById` (in `audit/access-log.ts`) needs to
 * convert both hot (`AccessLogRow`) and cold (`AccessLogColdRow`) rows
 * into the same `AccessLogItem` shape — the two row types are
 * structurally identical (`Selectable<AccessLogTable>`), so a single
 * converter avoids drift.
 */
export declare function toAccessLogItem(row: AccessLogColdRow): AccessLogItem;
//# sourceMappingURL=load-access-log-range.d.ts.map