/**
 * Audit producer → unified `AuditLog` adapters (Patch B).
 *
 * Each producer (AUTO.3 capability gate, SCHED.1 webhook server, DURABLE.4
 * resumer, AUTO.6 inbound router) ships its own audit-sink interface in a
 * producer-specific shape. The CLI.5 `AuditLog` is the single libsql-backed
 * landing table. These adapters are the glue: each `adaptXxx(auditLog)`
 * returns a sink that satisfies the producer's interface and translates
 * each event variant into a unified `AuditEntry` via `auditLog.append`.
 *
 * Single-direction dependency: producers DO NOT import `AuditLog`. Only
 * this module touches both sides. Wiring lives at the daemon construction
 * site (separate commit) — this patch ships the adapter functions + tests
 * only.
 *
 * `void auditLog.append(...)` is intentional fire-and-forget — the
 * `AuditLog` class handles its own write errors (see `audit_log.ts` init +
 * insert flow) and constraint C10 forbids audit-sink errors from
 * influencing producer verdicts. The producer's `try/catch` around the
 * sink (CapabilityGate.audit) already swallows any thrown exceptions; the
 * `Promise` returned by `append` resolves independently.
 *
 * PII discipline: no producer event variant carries raw secrets / bearer
 * tokens / signing keys. WebhookServer audit explicitly carries only
 * `subscriptionId` (never `signingSecret`); InboundRouter carries
 * `sender` (an externally-visible principal, not a credential); Resumer
 * carries error messages already stringified at the producer boundary.
 * No additional `hashDetailValue` wrapping is required at the adapter
 * boundary — producers pre-hash any sensitive value before it reaches
 * the sink.
 */
import type { AuditLog as CapabilityGateAuditSink } from './capability_gate.js';
import type { AuditLog } from './audit_log.js';
import type { AuditSink as ResumerAuditSink } from './durable/resumer.js';
import type { WebhookAuditSink } from './webhook_server.js';
import type { InboundRouterAuditSink } from '../channels/inbound_router.js';
/** Injected clock — defaults to `Date.now`. Tests pass a fixed-tick fn. */
export type NowFn = () => number;
/**
 * AUTO.3 capability gate → unified audit.
 *
 * Mapping:
 *   - category = `'capability_gate'`
 *   - decision = `verdict.allowed ? 'allowed' : 'denied'`
 *   - packId   = `req.pack`
 *   - detail   = `{ event_subtype: verdict.source, capability, target,
 *                   method?, source, message? }`
 *
 * `source` is duplicated as both `event_subtype` (queryable subtype across
 * all categories) and `source` (verbatim from verdict) so downstream
 * dashboards can pivot either way.
 */
export declare function adaptCapabilityGate(auditLog: AuditLog, now?: NowFn): CapabilityGateAuditSink;
/**
 * SCHED.1 webhook server → unified audit.
 *
 * Mapping per event variant:
 *   - `received | dispatched | idempotent | deliver_only` → `success`
 *   - `rejected_method | rejected_unknown | rejected_hmac | rejected_rate_limit` → `denied`
 *   - `error` → `error`
 *
 * `packId` is undefined — webhook auth is daemon-level. The
 * `subscriptionId` (when present) lives in `detail` so per-subscription
 * queries route via detail-JSON filter, not the indexed column.
 */
export declare function adaptWebhookServer(auditLog: AuditLog, now?: NowFn): WebhookAuditSink;
/**
 * DURABLE.4 resumer → unified audit.
 *
 * Mapping (per Patch B spec lock):
 *   - `resume_run | resume_skipped | resume_summary` → `success`
 *     (no current variant maps to `denied`; skips are normal control
 *     flow — pack uninstalled / version diverged — not a security
 *     verdict. `evaluator_error` skips ride along inside `resume_skipped`
 *     and stay `success` at the audit-decision level; the `reason` field
 *     in detail carries the discriminator.)
 *
 * `packId` is set when the variant carries one (`resume_run` has it;
 * `resume_summary` and `resume_skipped` don't).
 */
export declare function adaptResumer(auditLog: AuditLog, now?: NowFn): ResumerAuditSink;
/**
 * AUTO.6 inbound router → unified audit.
 *
 * Mapping per event variant:
 *   - `inbound_dispatched | inbound_subscribed` → `success`
 *   - `inbound_sender_denied` → `denied`
 *   - `inbound_unmapped | inbound_no_adapter | inbound_adapter_not_inboundable
 *      | inbound_dispatch_error` → `error`
 *
 * Uses the new `'channel_inbound'` category (Patch B extends
 * `AuditCategory`); outbound channel sends remain on `'channel_send'`.
 * `packId` pulls from `entry.pack` (every variant carries it via
 * `AuditCommon`).
 */
export declare function adaptInboundRouter(auditLog: AuditLog, now?: NowFn): InboundRouterAuditSink;
//# sourceMappingURL=audit_adapters.d.ts.map