/**
 * Append-only audit log for sandbox security events.
 * Never log real secret values — only token IDs and metadata.
 */
export declare const AUDIT_EVENT_TYPES: readonly ["sandbox_mode_transition", "secret_token_replacement_outbound", "secret_sanitization_inbound", "privileged_capability_invocation", "policy_decision", "signing_request_submitted", "signing_request_rejected", "signing_request_approved", "plugin_fallback_attempt", "security_kill_switch", "sandbox_lifecycle", "fetch_proxy_error"];
export type AuditEventType = (typeof AUDIT_EVENT_TYPES)[number];
export declare const AUDIT_SEVERITIES: readonly ["info", "warn", "error", "critical"];
export type AuditSeverity = (typeof AUDIT_SEVERITIES)[number];
export interface AuditEntry {
    timestamp: string;
    type: AuditEventType;
    summary: string;
    metadata?: Record<string, string | number | boolean | null>;
    severity: AuditSeverity;
    traceId?: string;
}
export interface AuditLogConfig {
    console?: boolean;
    maxEntries?: number;
    sink?: (entry: AuditEntry) => void;
}
export interface AuditFeedQuery {
    type?: AuditEventType;
    severity?: AuditSeverity;
    sinceMs?: number;
    limit?: number;
}
export type AuditFeedSubscriber = (entry: AuditEntry) => void;
export declare function queryAuditFeed(query?: AuditFeedQuery): AuditEntry[];
export declare function getAuditFeedSize(): number;
export declare function subscribeAuditFeed(subscriber: AuditFeedSubscriber): () => void;
/** @internal Test-only helper to isolate process-wide audit state between specs. */
export declare function __resetAuditFeedForTests(): void;
export declare class SandboxAuditLog {
    private entries;
    private consoleEnabled;
    private maxEntries;
    private sink?;
    constructor(config?: AuditLogConfig);
    record(entry: Omit<AuditEntry, "timestamp">): void;
    recordTokenReplacement(direction: "outbound" | "inbound", url: string, tokenIds: string[]): void;
    recordCapabilityInvocation(capability: string, detail: string, metadata?: Record<string, string | number | boolean>): void;
    recordPolicyDecision(decision: "allow" | "deny", reason: string, metadata?: Record<string, string | number | boolean>): void;
    getRecent(count?: number): AuditEntry[];
    getByType(type: AuditEventType, count?: number): AuditEntry[];
    get size(): number;
    clear(): void;
}
//# sourceMappingURL=audit-log.d.ts.map