/**
 * AuditLogger — append-only operational audit trail for the secrets store.
 *
 * Hot-path resolves (get) are NOT audited — that would create N×requests
 * log volume. We audit writes, deletes, rotations, tests, metadata reads
 * from UI/API, master-key rotations, and AEAD decrypt failures (security
 * signal).
 *
 * The schema captures both user and system actors via a discriminated
 * (`actor_type`, `actor_user_id`, `actor_system_id`) triple.
 *
 * After the scope-collapse refactor, audit rows no longer carry a scope
 * dimension. Legacy migration code may still pass `scope` / `scope_id`
 * fields on the AuditEvent for backward compatibility while it
 * decrypts pre-migration rows — those fields are simply ignored.
 */
import type Database from 'better-sqlite3';
import type { ActorContext } from './SecretStore.js';
export type AuditAction = 'set' | 'delete' | 'test' | 'describe' | 'rotate_master' | 'decrypt_fail' | 'bundle_export' | 'bundle_import' | 'migrate';
export interface AuditEvent {
    action: AuditAction;
    actor: ActorContext;
    key?: string;
    success: boolean;
    /** Non-secret context, e.g. `{ rowCount: 42 }` for rotate_master. */
    detail?: Record<string, unknown>;
    /** @deprecated kept for migration call sites; ignored at insert time. */
    scope?: string;
    /** @deprecated kept for migration call sites; ignored at insert time. */
    scope_id?: string;
}
export declare class AuditLogger {
    private readonly insert;
    constructor(db: Database.Database);
    write(event: AuditEvent): void;
}
