/**
 * Forensic query helpers for the defence audit log
 */
import type { AuditEntry, FirewallResult } from '../types.js';
export interface AgentInfo {
    source_type: string;
    source_identifier: string;
    operation_count: number;
    last_seen: string;
    avg_trust_score: number;
    min_trust_score: number;
    max_trust_score: number;
    flagged_count: number;
}
export interface AgentTimelinePoint {
    timestamp: string;
    trust_score: number;
    firewall_result: string;
    anomaly_score: number;
}
export interface AuditQueryOptions {
    startTime?: string;
    endTime?: string;
    operation?: 'write' | 'read' | 'delete' | 'update';
    source?: string;
    firewallResult?: FirewallResult;
    memoryId?: number;
    project?: string;
    limit?: number;
}
export interface AuditStats {
    totalOperations: number;
    allowedCount: number;
    blockedCount: number;
    quarantinedCount: number;
    topSources: {
        source: string;
        count: number;
    }[];
    threatBreakdown: Record<string, number>;
}
/**
 * Query audit logs with flexible filters.
 */
export declare function queryAuditLogs(options?: AuditQueryOptions): AuditEntry[];
/**
 * Get aggregate audit statistics for a time range.
 */
export declare function getAuditStats(timeRange: '24h' | '7d' | '30d', project?: string): AuditStats;
/**
 * Get distinct agents aggregated from audit logs.
 */
export declare function queryAgentRegistry(timeRange?: '24h' | '7d' | '30d', project?: string): AgentInfo[];
/**
 * Get trust score timeline for a specific agent.
 */
export declare function queryAgentTimeline(identifier: string, timeRange?: '24h' | '7d' | '30d', project?: string): AgentTimelinePoint[];
/**
 * Get paginated audit entries for a specific agent.
 */
export declare function queryAgentOperations(identifier: string, options?: {
    limit?: number;
    offset?: number;
    firewallResult?: FirewallResult;
    project?: string;
}): AuditEntry[];
//# sourceMappingURL=queries.d.ts.map