/**
 * Security audit log — reader/writer for the JSONL trail written by
 * `.claude/helpers/audit-log-writer.cjs` (gates-handler.cjs's block/deny
 * decisions) and consumed by `monomind security audit`.
 *
 * Deliberately separate from `src/consensus/audit-writer.ts` (HMAC-signed,
 * built for monoswarm vote audits — no adversary model applies to a local
 * security log a user can already edit their own files in) and from the
 * high-volume general event log under `.git/monomind/events/` (so `clear`
 * can truncate this log without wiping unrelated debug telemetry).
 *
 * Path resolution mirrors getMonomindDataRoot() — same canonical,
 * branch-agnostic, worktree-shared root every other monomind data file uses.
 */
export interface AuditEvent {
    timestamp: string;
    source: string;
    decision: string;
    tool?: string;
    reason?: string;
    path?: string;
}
export declare function resolveAuditLogPaths(cwd?: string): {
    dir: string;
    file: string;
};
/** Append one audit event. Mirrors the CJS writer's rotation behavior. */
export declare function appendAuditEvent(event: Omit<AuditEvent, 'timestamp'>, cwd?: string): void;
/**
 * Read audit events, most recent last (file order). Bounded to
 * MAX_LINES_READ lines to avoid loading an unbounded file into memory —
 * the rotation in appendAuditEvent already caps the file at ~25MB, this is
 * a second, cheaper bound on line count.
 */
export declare function readAuditEvents(cwd?: string): AuditEvent[];
export declare function filterAuditEvents(events: AuditEvent[], filter?: string): AuditEvent[];
/**
 * Archive-then-truncate: renames the live log to a timestamped `.bak`
 * rather than deleting, so `clear` never silently destroys the trail it
 * exists to preserve. Returns the archived path, or null if there was
 * nothing to clear.
 */
export declare function clearAuditLog(cwd?: string): {
    archived: string | null;
    cleared: number;
};
//# sourceMappingURL=audit-log.d.ts.map