export type SecretAuditEvent = 'secrets.get' | 'secrets.unlocked' | 'secrets.create' | 'secrets.import' | 'secrets.export' | 'secrets.view' | 'secrets.lease-denied' | 'secrets.lease-expire';
export interface SecretAuditParams {
    /** Which audit event this is — a read (`secrets.get`) or an unlock grant. */
    event: SecretAuditEvent;
    /** Bundle name (never a value). */
    bundle?: string;
    /** Raw keychain item/service name for `secrets get <item>` (never a value). */
    item?: string;
    /** Free-form operation/caller label, e.g. 'export to shell', 'unlock'. */
    operation?: string;
    /**
     * Where the read/grant originated: agent | session | reveal | raw-item |
     * remote | sync-push | broker | broker+durable.
     */
    source?: string;
    status?: 'success' | 'error';
    /** Env/key NAMES exposed — names only, never values. */
    keys?: string[];
    keyCount?: number;
    /** Subset of `keys` backed by the OS keychain — names only. */
    keychainKeys?: string[];
    /** Count of resolved values by kind (literal / keychain / env / ...). */
    kindCounts?: Record<string, number>;
    /**
     * Resolving agent/harness identity the access was scoped to (`*` = a global
     * grant readable by every harness). Falls back to `$AGENTS_AGENT_NAME`.
     */
    agent?: string;
    /** Remote host the value was pulled from, when applicable. */
    host?: string;
    /** Grant lifetime in ms (`secrets.unlocked` only). */
    ttlMs?: number;
    error?: string;
}
/**
 * The agent/harness identity to attribute a secret access to. Explicit callers
 * (the bundle reader knows the scope it resolved under) win; otherwise fall back
 * to the ambient `$AGENTS_AGENT_NAME` set on every agent launch.
 */
export declare function resolveAuditAgent(explicit?: string): string | undefined;
/**
 * Emit one value-free secret audit event to the raw/operational event stream and
 * the persisted audit log. Only ever pass metadata — the secret value must never
 * reach this function.
 */
export declare function emitSecretAudit(p: SecretAuditParams): void;
