/**
 * `secret_audit_log` cold-store adapter (Orchestrator side).
 *
 *
 * Contract:
 *   - tenant column: `routing_key` (NULL → synthetic `__orchestrator__`)
 *   - partition column: `timestamp`
 *   - warm TTL: 90 days (longer window than other audit tables — design
 *     §5 matrix row 10. Volume is low, forensic value is high)
 *
 * Synthetic tenant: rows without `routing_key` (e.g. orchestrator-level
 * key rotations done before any source is bound) collapse to a single
 * synthetic prefix `__orchestrator__`. Mirrors the same pattern already
 * used for `event_log` payload keys when the routing key is missing.
 */
import { type Kysely, type Selectable } from 'kysely';
import { type ChunkCommitMetadata, type ColdRetention, type ColdStoreTableConfig, type EligiblePartition, type TableAdapter } from '@kici-dev/shared';
import type { Database, SecretAuditLogTable } from '../../db/types.js';
export type SecretAuditLogRow = Selectable<SecretAuditLogTable>;
export interface SecretAuditLogAdapterOptions {
    overrides?: Partial<ColdStoreTableConfig>;
}
export declare class SecretAuditLogAdapter implements TableAdapter<SecretAuditLogRow> {
    private readonly kdb;
    private readonly instanceId;
    readonly db: "orchestrator";
    readonly table = "secret_audit_log";
    readonly tenantColumn = "routing_key";
    readonly partitionColumn = "timestamp";
    readonly config: ColdStoreTableConfig;
    constructor(kdb: Kysely<Database>, instanceId: string, opts?: SecretAuditLogAdapterOptions);
    listEligiblePartitions(args: {
        warmCutoff: Date;
    }): AsyncIterable<EligiblePartition>;
    countTenantWarmBytes(args: {
        tenantId: string;
        warmCutoff: Date;
    }): Promise<number>;
    withPartitionLock<T>(args: {
        tenantId: string;
        partitionDate: string;
    }, fn: () => Promise<T>): Promise<T | null>;
    selectEligible(args: {
        tenantId: string;
        partitionDate: string;
        limit: number;
    }): AsyncIterable<SecretAuditLogRow>;
    encodeRow(row: SecretAuditLogRow): string;
    decodeRow(line: string): SecretAuditLogRow;
    rowId(row: SecretAuditLogRow): string | number;
    rowTimestamp(row: SecretAuditLogRow): Date | string;
    /**
     * Phase 2 — per-row cold-retention TTL. Sampled `resolve` /
     * `resolve_named` rows get 180d cold; mutations get `'forever'`. The
     * denied-outcome override promotes to 730d (forensic).
     *
     * `outcome` is a free-form string in PG but the engine helper only
     * branches on `outcome !== 'allowed'`, so any other value
     * (`'denied'`, `'error'`, future categories) lands in the forensic
     * bucket.
     */
    coldTtlDays(row: SecretAuditLogRow): ColdRetention;
    markArchivedAndDelete(args: {
        rowIds: ReadonlyArray<string | number>;
        chunkMeta: ChunkCommitMetadata;
    }): Promise<void>;
    purgeChunkRecord(args: {
        tenantId: string;
        chunkId: string;
        gzipBytes: number;
        rowCount: number;
        bucket: string;
        maxColdDays: number;
        objectKey: string;
    }): Promise<void>;
}
//# sourceMappingURL=secret-audit-log.d.ts.map