/**
 * Audit Logger for NotebookLM MCP Server
 *
 * Provides comprehensive audit logging with:
 * - Tool invocation logging
 * - Authentication event logging
 * - Session lifecycle logging
 * - Security event logging
 * - Tamper detection via hash chaining
 * - Log rotation and retention
 *
 * Added by Pantheon Security for hardened fork.
 */
/**
 * Audit event types
 */
export type AuditEventType = "tool" | "auth" | "session" | "security" | "system" | "compliance" | "data_access" | "configuration" | "retention";
/**
 * Security severity levels
 */
export type SecuritySeverity = "info" | "warning" | "error" | "critical";
/**
 * Audit event structure
 */
export interface AuditEvent {
    timestamp: string;
    eventType: AuditEventType;
    eventName: string;
    success: boolean;
    duration_ms?: number;
    details: Record<string, unknown>;
    hash: string;
    previousHash: string;
}
/**
 * Audit logger configuration
 */
export interface AuditConfig {
    enabled: boolean;
    logDir: string;
    retentionDays: number;
    includeDetails: boolean;
    hashChainEnabled: boolean;
}
/**
 * Audit Logger Class
 *
 * Thread-safe audit logging with hash chain integrity verification.
 */
export declare class AuditLogger {
    private static readonly MISSING_HASH_WARNING;
    private static instances;
    private static processHandlersRegistered;
    private config;
    private currentLogFile;
    private previousHash;
    private checkpointPath;
    private checkpointKey;
    private writeQueue;
    private pendingEvents;
    private hashChainWarningLogged;
    private writeFailureLogged;
    private eventSubscribers;
    private stats;
    constructor(config?: Partial<AuditConfig>);
    /**
     * Ensure audit log directory exists
     */
    private ensureLogDirectory;
    /**
     * Initialize log file for today
     */
    private initializeLogFile;
    /** Return the last hash from the most recent audit file before `today`, or null. */
    private findPreviousDayLastHash;
    /**
     * Clean up old log files based on retention policy
     */
    private cleanOldLogs;
    /**
     * Compute hash for an event (includes previous hash for chaining)
     */
    private computeHash;
    /**
     * Sanitize details object for logging (remove sensitive data)
     */
    private sanitizeDetails;
    /**
     * Write event to log file
     */
    private writeEvent;
    private flushEvent;
    /**
     * Subscribe to audit events as they are written to disk (I244)
     */
    onEvent(handler: (event: AuditEvent) => Promise<void>): void;
    /**
     * Log a generic event
     */
    private log;
    /**
     * Log a tool invocation
     */
    logToolCall(toolName: string, args: Record<string, unknown>, success: boolean, duration_ms: number, error?: string): Promise<void>;
    /**
     * Log an authentication event
     */
    logAuthEvent(eventName: string, success: boolean, details?: Record<string, unknown>): Promise<void>;
    /**
     * Log a session lifecycle event
     */
    logSessionEvent(eventName: string, sessionId: string, details?: Record<string, unknown>): Promise<void>;
    /**
     * Log a security event
     */
    logSecurityEvent(eventName: string, severity: SecuritySeverity, details?: Record<string, unknown>): Promise<void>;
    /**
     * Log a system event
     */
    logSystemEvent(eventName: string, details?: Record<string, unknown>): Promise<void>;
    /**
     * Log a compliance event (GDPR, SOC2, CSSF)
     */
    logComplianceEvent(eventName: string, category: string, details?: Record<string, unknown>): Promise<void>;
    /**
     * Log a data access event (for DSAR tracking)
     */
    logDataAccessEvent(action: "view" | "export" | "delete" | "request", dataType: string, details?: Record<string, unknown>): Promise<void>;
    /**
     * Log a configuration change event
     */
    logConfigChange(setting: string, oldValue: unknown, newValue: unknown, changedBy?: string): Promise<void>;
    /**
     * Log a data retention event
     */
    logRetentionEvent(action: "cleanup" | "archive" | "delete", dataType: string, count: number, details?: Record<string, unknown>): Promise<void>;
    /**
     * Summarize tool arguments (avoid logging full content)
     */
    private summarizeArgs;
    /**
     * Get audit statistics
     */
    getStats(): typeof this.stats;
    /**
     * Verify integrity of audit log file
     */
    verifyIntegrity(logFile?: string): Promise<{
        valid: boolean;
        errors: string[];
    }>;
    /**
     * Force flush any pending writes
     */
    flush(): Promise<void>;
    private getLogFilePathForTimestamp;
    /** Compute the HMAC signature for a checkpoint hash, or null when no key is set. */
    private signCheckpoint;
    /**
     * Persist the latest chain hash to the external checkpoint (outside the log dir).
     * Best-effort: a failure here must never break audit writes.
     */
    private writeCheckpoint;
    /** Read the external checkpoint, returning null if absent or unreadable. */
    private readCheckpoint;
    private disableHashChainForSession;
    private handleWriteFailure;
    private registerProcessHandlers;
    private static flushAllSync;
    private flushPendingEventsSync;
    private writeWithSyncLock;
}
/**
 * Get or create the global audit logger
 */
export declare function getAuditLogger(): AuditLogger;
/**
 * Convenience functions for quick logging
 */
export declare const audit: {
    tool: (name: string, args: Record<string, unknown>, success: boolean, duration_ms: number, error?: string) => Promise<void>;
    auth: (event: string, success: boolean, details?: Record<string, unknown>) => Promise<void>;
    session: (event: string, sessionId: string, details?: Record<string, unknown>) => Promise<void>;
    security: (event: string, severity: SecuritySeverity, details?: Record<string, unknown>) => Promise<void>;
    system: (event: string, details?: Record<string, unknown>) => Promise<void>;
    compliance: (event: string, category: string, details?: Record<string, unknown>) => Promise<void>;
    dataAccess: (action: "view" | "export" | "delete" | "request", dataType: string, details?: Record<string, unknown>) => Promise<void>;
    configChange: (setting: string, oldValue: unknown, newValue: unknown, changedBy?: string) => Promise<void>;
    retention: (action: "cleanup" | "archive" | "delete", dataType: string, count: number, details?: Record<string, unknown>) => Promise<void>;
};