import { CircuitBreakerOpenError } from '../common/circuit-breaker.js';
import type { ID } from '../common/types.js';
export { CircuitBreakerOpenError };
export type AuditAction = 'intent.create' | 'intent.read' | 'intent.read_list' | 'intent.update' | 'intent.delete' | 'escalation.read' | 'escalation.approve' | 'escalation.reject' | 'webhook.read' | 'webhook.read_deliveries' | 'webhook.read_delivery' | 'webhook.read_failed_deliveries' | 'webhook.replay' | 'gdpr.export' | 'gdpr.erase';
export type AuditResourceType = 'intent' | 'escalation' | 'webhook' | 'user_data';
export interface AuditEntry {
    id: string;
    tenantId: string;
    userId: string;
    action: AuditAction;
    resourceType: AuditResourceType;
    resourceId: string;
    metadata?: Record<string, unknown>;
    ipAddress?: string;
    userAgent?: string;
    timestamp: Date;
}
export type CreateAuditEntry = Omit<AuditEntry, 'id' | 'timestamp'>;
export interface AuditQueryFilters {
    tenantId: ID;
    userId?: string;
    action?: AuditAction;
    resourceType?: AuditResourceType;
    resourceId?: string;
    from?: Date;
    to?: Date;
    limit?: number;
    offset?: number;
}
export interface AuditQueryResult {
    entries: AuditEntry[];
    total: number;
    hasMore: boolean;
}
/**
 * Get the current audit DLQ size for monitoring/alerting
 * @returns Number of entries in the DLQ
 */
export declare function getAuditDlqSize(): Promise<number>;
/**
 * Record an audit entry asynchronously.
 * Uses a queue to batch writes and avoid blocking the request path.
 *
 * @param entry - The audit entry to record (without id and timestamp)
 */
export declare function recordAudit(entry: CreateAuditEntry): Promise<void>;
/**
 * Record an audit entry synchronously (for testing or critical paths).
 * Prefer recordAudit() for production use.
 * Protected by circuit breaker to prevent cascading failures.
 *
 * @param entry - The audit entry to record
 * @returns The created audit entry with id and timestamp
 * @throws CircuitBreakerOpenError if the audit service circuit breaker is open
 */
export declare function recordAuditSync(entry: CreateAuditEntry): Promise<AuditEntry>;
/**
 * Query audit log entries for compliance reporting.
 * Supports filtering by user, action, resource, and time range.
 * Protected by circuit breaker to prevent cascading failures.
 *
 * @param filters - Query filters
 * @returns Paginated audit entries
 * @throws CircuitBreakerOpenError if the audit service circuit breaker is open
 */
export declare function queryAuditLog(filters: AuditQueryFilters): Promise<AuditQueryResult>;
/**
 * Get audit entries for a specific resource.
 * Useful for showing access history on a detail page.
 *
 * @param tenantId - Tenant identifier
 * @param resourceType - Type of resource
 * @param resourceId - Resource identifier
 * @param limit - Maximum entries to return
 * @returns Recent audit entries for the resource
 */
export declare function getResourceAuditHistory(tenantId: ID, resourceType: AuditResourceType, resourceId: string, limit?: number): Promise<AuditEntry[]>;
/**
 * Get audit entries for a specific user.
 * Useful for user activity reports and compliance audits.
 *
 * @param tenantId - Tenant identifier
 * @param userId - User identifier
 * @param options - Query options
 * @returns Audit entries for the user
 */
export declare function getUserAuditHistory(tenantId: ID, userId: string, options?: {
    from?: Date;
    to?: Date;
    limit?: number;
}): Promise<AuditEntry[]>;
/**
 * Gracefully shutdown the audit system.
 * Flushes any pending entries before returning.
 */
export declare function shutdownAuditSystem(): Promise<void>;
/**
 * Extract request metadata for audit logging.
 * Helper function to standardize metadata extraction from requests.
 *
 * @param request - Fastify request object
 * @returns Metadata object with IP and user agent
 */
export declare function extractRequestMetadata(request: {
    ip?: string;
    headers?: Record<string, string | string[] | undefined>;
}): {
    ipAddress?: string;
    userAgent?: string;
};
//# sourceMappingURL=audit.d.ts.map