/**
 * Audit logger for secrets management operations.
 *
 * Records all secret access/denial events to the secret_audit_log table
 * for compliance and security monitoring.
 *
 * Phase D: query() supports cold-store read-through via the optional
 * `coldStore` constructor argument and an `includeArchived` query
 * filter. Hot-only behavior is unchanged when neither is supplied.
 */
import type { Kysely } from 'kysely';
import type { ColdStore } from '@kici-dev/shared';
import type { Database, SecretAuditLogRow } from '../db/types.js';
import { type AuditEntry } from '@kici-dev/engine';
/**
 * Audit logger that writes secret operation events to PostgreSQL.
 */
export declare class AuditLogger {
    private readonly db;
    private coldStore;
    constructor(db: Kysely<Database>, coldStore?: ColdStore);
    /**
     * Late-binding setter so the orchestrator-core wiring can build the
     * AuditLogger before the cold-store singleton (which depends on env
     * + S3 client init) and attach it later.
     */
    setColdStore(coldStore: ColdStore | null): void;
    /**
     * Log a secret operation event.
     *
     * `resolve` / `resolve_named` allowed entries are sampled at 1% (per the
     * engine's `shouldRecordSecretResolve` helper) since they're written
     * once per JOB-step secret resolution and dwarf every other action's
     * volume. Denied resolves and every other action (`setSecret`,
     * `deleteSecret`, `rotateKey`, `secret-outputs.reveal`) bypass the
     * sampler — they are transactional with the mutation and must always
     * land.
     *
     * @param entry - The audit entry to record.
     */
    log(entry: AuditEntry): Promise<void>;
    /**
     * Query audit log entries with optional filters.
     *
     * @param opts - Query filters and pagination.
     * @returns Matching audit log rows ordered by timestamp descending.
     */
    query(opts: {
        contextName?: string;
        routingKey?: string;
        action?: string;
        from?: Date;
        to?: Date;
        limit?: number;
        offset?: number;
        /**
         * Phase D opt-in. When true, falls through to cold-store via
         * `loadSecretAuditLogRange` for any portion of the requested
         * window past the warm cutoff. Default false preserves the
         * original semantics.
         */
        includeArchived?: boolean;
    }): Promise<SecretAuditLogRow[]>;
}
//# sourceMappingURL=audit-logger.d.ts.map