/**
 * Forensic query helpers for the defence audit log
 */
import type { AuditEntry, FirewallResult } from '../types.js';
export interface AgentInfo {
    source_type: string;
    source_identifier: string;
    operation_count: number;
    last_seen: string;
    avg_trust_score: number;
    min_trust_score: number;
    max_trust_score: number;
    flagged_count: number;
}
export interface AgentTimelinePoint {
    timestamp: string;
    trust_score: number;
    firewall_result: string;
    anomaly_score: number;
}
export interface AuditQueryOptions {
    startTime?: string;
    endTime?: string;
    operation?: 'write' | 'read' | 'delete' | 'update';
    source?: string;
    firewallResult?: FirewallResult;
    memoryId?: number;
    project?: string;
    limit?: number;
}
export interface AuditStats {
    totalOperations: number;
    allowedCount: number;
    blockedCount: number;
    quarantinedCount: number;
    topSources: {
        source: string;
        count: number;
    }[];
    threatBreakdown: Record<string, number>;
}
export interface IncidentReplayOptions {
    startTime?: string;
    endTime?: string;
    project?: string;
    sourceIdentifier?: string;
    memoryId?: number;
    limit?: number;
}
export interface IncidentReplayEntry {
    timestamp: string;
    type: 'audit' | 'quarantine' | 'event';
    eventType: string;
    severity: 'info' | 'warning' | 'critical';
    summary: string;
    details?: string | null;
    source?: string;
    memoryId?: number | null;
    auditId?: number | null;
    quarantineId?: number | null;
    metadata?: Record<string, unknown>;
}
/**
 * Query audit logs with flexible filters.
 */
export declare function queryAuditLogs(options?: AuditQueryOptions): AuditEntry[];
/**
 * Get aggregate audit statistics for a time range.
 */
export declare function getAuditStats(timeRange: '24h' | '7d' | '30d', project?: string): AuditStats;
export interface LifetimeStats {
    totalScans: number;
    threatsBlocked: number;
    quarantined: number;
    credentialLeaks: number;
    memoriesProtected: number;
}
/**
 * Get all-time aggregate stats.
 *
 * defence_audit is now retention-bounded (see src/defence/audit/retention.ts):
 * old rows are periodically purged so the table can't grow until it bricks the
 * DB at the 100MB hard limit. To keep these lifetime totals correct, every purge
 * first rolls the to-be-deleted rows' contributions into the single-row
 * `audit_aggregates` table. So the lifetime total is `aggregate + scan(live)` —
 * the aggregate carries the purged history and the COUNT scan covers the
 * (bounded) rows still on disk. This guarantees totals never go backwards after
 * a purge. The credential LIKE scan is over a bounded table now, so it's fine.
 */
export declare function getLifetimeStats(): LifetimeStats;
/**
 * Get distinct agents aggregated from audit logs.
 */
export declare function queryAgentRegistry(timeRange?: '24h' | '7d' | '30d', project?: string): AgentInfo[];
/**
 * Get trust score timeline for a specific agent.
 */
export declare function queryAgentTimeline(identifier: string, timeRange?: '24h' | '7d' | '30d', project?: string): AgentTimelinePoint[];
/**
 * Get paginated audit entries for a specific agent.
 */
export declare function queryAgentOperations(identifier: string, options?: {
    limit?: number;
    offset?: number;
    firewallResult?: FirewallResult;
    project?: string;
}): AuditEntry[];
export declare function queryIncidentReplay(options?: IncidentReplayOptions): IncidentReplayEntry[];
