/**
 * Event stream families — sessions-style --include / --exclude for the unified
 * event reader. One vocabulary maps onto existing filters (includeActivity,
 * eventTypes, level) so the engine stays single-path.
 */
import type { EventType } from './feed/events.js';
import type { UnifiedQuery } from './event-stream.js';
export declare const EVENT_FAMILIES: readonly ["ops", "activity", "commands", "runs", "security"];
export type EventFamily = (typeof EVENT_FAMILIES)[number];
export declare function isEventFamily(value: string): value is EventFamily;
/**
 * Parse a comma-separated family list. Throws on unknown names or empty list
 * after split (same discipline as sessions role lists).
 */
export declare function parseFamilyList(raw: string, flagName: string): EventFamily[];
/** Command-churn event kinds. */
export declare const COMMAND_EVENT_TYPES: readonly EventType[];
/** Run-dispatch outcome kinds (replaces the separate audit/log.jsonl product). */
export declare const RUN_EVENT_TYPES: readonly EventType[];
/**
 * Fold family include/exclude into a UnifiedQuery.
 * Precedence: family narrows sources/types; field filters (module, event, …)
 * still apply on top.
 *
 * --include and --exclude are mutually exclusive at the CLI layer; this
 * function accepts only one of includeFamilies / excludeFamilies.
 */
export declare function applyFamilies(q: UnifiedQuery): UnifiedQuery;
