/**
 * User and Audit Log Operations for DatabaseService
 *
 * Provides CRUD operations for users and audit_log tables.
 * Users represent identity for multi-user collaboration.
 * Audit log tracks user actions for compliance and accountability.
 *
 * CRITICAL: NEVER use console.log() - stdout is reserved for JSON-RPC protocol.
 *
 * @module database/user-operations
 */
import type Database from 'better-sqlite3';
export interface User {
    id: string;
    external_id: string | null;
    display_name: string;
    email: string | null;
    role: string;
    created_at: string;
    last_active_at: string | null;
    metadata_json: string;
}
export interface AuditLogEntry {
    id: number;
    user_id: string | null;
    session_id: string | null;
    action: string;
    entity_type: string | null;
    entity_id: string | null;
    details_json: string;
    ip_address: string | null;
    created_at: string;
}
export interface CreateUserParams {
    display_name: string;
    external_id?: string | null;
    email?: string | null;
    role?: string;
    metadata_json?: string;
}
export interface InsertAuditLogParams {
    user_id: string | null;
    session_id: string | null;
    action: string;
    entity_type?: string | null;
    entity_id?: string | null;
    details_json?: string;
    ip_address?: string | null;
}
export interface AuditLogQueryFilters {
    user_id?: string;
    action?: string;
    entity_type?: string;
    entity_id?: string;
    date_from?: string;
    date_to?: string;
    limit?: number;
    offset?: number;
}
export interface ListUsersOptions {
    role?: string;
    limit?: number;
    offset?: number;
}
/**
 * Ensure a user exists in the users table, auto-provisioning if necessary.
 *
 * When an operation references a user_id via FK, we must ensure the user row
 * exists. If not found, we create a minimal user record with 'viewer' role.
 * This is proper user lifecycle management - users are created on first
 * reference rather than requiring explicit pre-registration.
 *
 * @param db - Database connection
 * @param userId - The user ID to ensure exists
 */
export declare function ensureUserExists(db: Database.Database, userId: string): void;
/**
 * Create a new user.
 * ID is auto-generated by SQLite (lower(hex(randomblob(16)))).
 *
 * @returns The created user record
 * @throws Error if external_id already exists (UNIQUE constraint)
 */
export declare function createUser(db: Database.Database, params: CreateUserParams): User;
/**
 * Get a user by internal ID
 */
export declare function getUser(db: Database.Database, userId: string): User | null;
/**
 * Get a user by external ID
 */
export declare function getUserByExternalId(db: Database.Database, externalId: string): User | null;
/**
 * Update the last_active_at timestamp for a user
 */
export declare function updateUserActivity(db: Database.Database, userId: string): void;
/**
 * List users with optional filters
 */
export declare function listUsers(db: Database.Database, options?: ListUsersOptions): User[];
/**
 * Insert an entry into the audit log
 */
export declare function insertAuditLog(db: Database.Database, params: InsertAuditLogParams): number;
/**
 * Query audit log with filters
 *
 * @returns Array of matching audit log entries, ordered by created_at DESC
 */
export declare function queryAuditLog(db: Database.Database, filters: AuditLogQueryFilters): {
    entries: AuditLogEntry[];
    total: number;
};
//# sourceMappingURL=user-operations.d.ts.map