/**
 * Read-through helper for `secret_audit_log` (Orchestrator) — Phase D.
 *
 * Mirrors the Phase B/C reader pattern. Wraps `AuditLogger.query()`'s
 * existing offset/limit shape; cold-store rows are fetched only when
 * `includeArchived === true`.
 *
 * Design contract: the `kici-admin secret audit` CLI surfaces an
 * explicit `--include-archived` flag; admin HTTP route mirrors via a
 * query param. Default is hot-only so existing tooling doesn't pay an
 * S3 round-trip on every invocation.
 *
 * Cold-side filter handling: any filter that the hot SELECT applies
 * (contextName, action, run_id, ...) is re-applied in-process to cold
 * rows after streaming. This is correct because cold chunks are
 * partitioned by `(routing_key, day)`, not by the secondary filters.
 */
import { type Kysely, type Selectable } from 'kysely';
import { type ColdStore } from '@kici-dev/shared';
import type { Database, SecretAuditLogTable } from '../db/types.js';
export type SecretAuditLogRow = Selectable<SecretAuditLogTable>;
export interface LoadSecretAuditLogRangeArgs {
    db: Kysely<Database>;
    coldStore: ColdStore | undefined;
    /** Optional filters mirroring AuditLogger.query(). */
    contextName?: string;
    routingKey?: string;
    action?: string;
    /** Inclusive lower bound on `timestamp`. */
    fromTs?: Date;
    /** Exclusive upper bound on `timestamp`. */
    toTs?: Date;
    limit: number;
    offset: number;
    includeArchived: boolean;
}
export declare function loadSecretAuditLogRange(args: LoadSecretAuditLogRangeArgs): Promise<SecretAuditLogRow[]>;
//# sourceMappingURL=load-secret-audit-log-range.d.ts.map