import type { Kysely } from 'kysely';
import { type ColdStore } from '@kici-dev/shared';
import { type AccessLogAction, type AccessLogItem, type AccessLogOutcome, type AccessLogRateLimiter, type AccessLogSource, type AccessLogTargetType, type ActorPrincipal, type ActorType } from '@kici-dev/engine';
import type { Database } from '../db/types.js';
export interface AccessLogRecord {
    orgId: string | null;
    routingKey: string | null;
    actor: ActorPrincipal;
    action: AccessLogAction;
    target: {
        type: AccessLogTargetType;
        id: string;
    } | null;
    requestId: string | null;
    source: AccessLogSource;
    outcome: AccessLogOutcome;
    errorMessage?: string | null;
    /**
     * Extra key/value pairs merged into `actor_meta` on insert. Lets
     * callers attach action-specific context (e.g. which dashboard-write
     * operation flipped) without overloading other columns. Values must
     * be JSON-serialisable.
     */
    meta?: Record<string, unknown>;
}
export interface AccessLogQueryFilter {
    orgId?: string;
    actorType?: ActorType;
    actorId?: string;
    action?: AccessLogAction;
    source?: AccessLogSource;
    outcome?: AccessLogOutcome;
    targetType?: AccessLogTargetType;
    targetId?: string;
    fromTimestamp?: Date | string;
    toTimestamp?: Date | string;
    /** Full-text search over error_message (trigram-indexed). */
    q?: string;
    limit?: number;
    cursor?: string;
}
export interface AccessLogQueryResult {
    items: AccessLogItem[];
    nextCursor: string | null;
}
/**
 * Best-effort writer for the orchestrator `access_log` table. Records one
 * row per read / orchestrator-admin mutation attributable to an
 * ActorPrincipal. Callers get their actor from the incoming Platform proxy
 * message (`msg.actor`) or from the admin HTTP auth chain.
 *
 * Failure mode: insert errors are logged and swallowed — a broken
 * access_log table MUST NOT take down dashboard reads. Use `secret_audit_log`
 * for the always-consistent secret mutation path; `access_log` is the
 * read + broad-surface audit stream.
 */
export declare class AccessLogWriter {
    private readonly db;
    private coldStore;
    private readonly rateLimiter;
    constructor(db: Kysely<Database>, coldStore?: ColdStore, rateLimiter?: AccessLogRateLimiter);
    /**
     * Late-binding setter for the cold-store handle. orchestrator-core
     * builds AccessLogWriter before the cold-store singleton, then
     * attaches it via this setter (mirrors AuditLogger.setColdStore).
     */
    setColdStore(coldStore: ColdStore | null): void;
    record(entry: AccessLogRecord): Promise<void>;
    /**
     * Phase D: delegates to `loadAccessLogRange` so cold-store rows are
     * merged transparently when pagination crosses the warm cutoff. The
     * caller-visible `{items, nextCursor}` shape is preserved. NO
     * --include-archived flag — access_log is "paginated/transparent"
     * per design §7 row 11.
     */
    query(filter: AccessLogQueryFilter): Promise<AccessLogQueryResult>;
    /**
     * Detail lookup by row id. Hot first; on miss falls back to a single
     * cold-store tenant scan filtering by `id`. Mirrors the
     * `loadEventLogByDeliveryId` pattern in `load-event-log-range.ts` —
     * cold-store is partitioned by `(tenant_id, day)` with no cross-tenant
     * `id` index, so the caller MUST scope the cold scan to one tenant.
     *
     * `opts.orgId` supplies the tenant scope. When omitted, only the
     * synthetic `__orchestrator__` tenant is scanned (matches the
     * NULL-org_id rows the orchestrator itself emits via
     * `cold-store-archive` / `cold-store-purge`). The CLI exposes this as
     * `kici-admin access-log show <id> --org-id <orgId>`.
     *
     * Best-effort contract: a cold-store error logs a warn line and
     * returns null, matching `loadAccessLogRange` and
     * `loadEventLogByDeliveryId`. A transient S3 outage MUST NOT
     * manufacture a misleading 404-vs-500 distinction at the HTTP layer.
     */
    getById(id: string, opts?: {
        orgId?: string;
    }): Promise<AccessLogItem | null>;
}
//# sourceMappingURL=access-log.d.ts.map