/**
 * ExecAuditLog — a persistent, append-only trail of every command Lemma ran or refused to
 * run, and every file it wrote, outside of what any single session's in-memory ledger keeps.
 *
 * TokenReceipt's sessionLedger (../utils/TokenReceipt.ts) records similar events but only
 * in a module-scoped array capped at 2000 entries and lost on process restart — fine for
 * "what did this session just do", useless for "what has Lemma ever done in this workspace".
 * This file exists so that question has a real, on-disk answer: same `~/.lemma-cache/`
 * convention as SavingsLedger, but append-only JSONL rather than whole-file rewrite, so a
 * crash mid-session can't lose prior entries.
 */
export type ExecAuditTool = "run_workspace_command" | "write_workspace_file" | "create_workspace_file" | "apply_workspace_patch";
export interface ExecAuditEntry {
    tool: ExecAuditTool;
    /** Command text for run_workspace_command, resolved file path for write/create/patch tools. */
    detail: string;
    allowed: boolean;
    /** Only set for run_workspace_command once it actually ran. */
    exitCode?: number | null;
    reason?: string;
    timestamp: string;
}
export declare function recordExecAudit(entry: Omit<ExecAuditEntry, "timestamp">): void;
/** Reads back the audit trail. Exposed mainly for tests; the file itself is plain JSONL. */
export declare function readExecAuditLog(limit?: number): ExecAuditEntry[];
export declare function getExecAuditLogPath(): string;
//# sourceMappingURL=ExecAuditLog.d.ts.map