import { type Kysely } from 'kysely';
/**
 * Access log: one row per read or orchestrator-admin mutation attributable
 * to an ActorPrincipal (dashboard user, api_key, service_account, platform
 * operator break-glass, or system). Backs:
 *
 * - dashboard "Data access" tab (dashboard.access-log.list message)
 * - orchestrator admin HTTP route GET /api/v1/admin/access-log
 * - kici-admin `access-log` CLI subcommand
 *
 * Covers reads + orchestrator-admin mutations uniformly. `secret_audit_log`
 * stays the source of truth for secret *mutation* events (kept separate for
 * historical reasons and different retention expectations); access_log
 * records secret *reveals* with full actor attribution.
 *
 * `source` distinguishes platform_proxy vs admin_http vs admin_cli entry
 * points. `actor_meta` captures the variant-specific extras that don't fit
 * in the flat (actor_type, actor_id) columns — ownerSub for api_key,
 * reason for platform_operator.
 *
 * Retention is TTL-based via expires_at; packages/orchestrator/src/queue/
 * cleanup.ts picks up the prune pass.
 */
export declare function up(db: Kysely<any>): Promise<void>;
export declare function down(db: Kysely<any>): Promise<void>;
//# sourceMappingURL=003_access_log.d.ts.map