/**
 * memory-journal-mcp — Operational Telemetry Logger
 *
 * Async-buffered JSONL writer for operational telemetry. Appends one
 * JSON object per line to a configurable file path, or writes to
 * stderr for containerised deployments (`--audit-log stderr`).
 *
 * Architecture aligned with postgres-mcp's production-proven logger:
 *   - JSONL format: one JSON object per line
 *   - Async buffered: 50-entry high-water mark + 100ms auto-flush
 *   - Rotation: configurable max size, keep 5 historical archives (.1–.5)
 *   - Graceful close: flushes remaining entries and stops the timer
 *   - Streaming tail-read: recent() reads only last 64KB for O(1) memory
 *   - stderr mode: `--audit-log stderr` routes to process.stderr
 *
 * Non-throwing by design: telemetry failures log to stderr but never
 * propagate to tool callers.
 */
import type { AuditConfig, AuditEntry, AuditSearchFilters } from './types.js';
export declare class AuditLogger {
    readonly config: AuditConfig;
    private buffer;
    private flushTimer;
    private flushQueue;
    private closed;
    private dirEnsured;
    private readonly stderrMode;
    private _droppedCount;
    constructor(config: AuditConfig);
    /**
     * Total number of events dropped due to memory limits or persistent I/O failure.
     */
    get droppedCount(): number;
    /**
     * Append an audit entry to the buffer.
     * Non-blocking — the entry is serialised and queued; the
     * actual file write happens on the next flush cycle.
     *
     * NOTE: This is a lossy operational telemetry mechanism, not a guaranteed immutable ledger.
     * Under extreme backpressure or persistent I/O failure, oldest entries will be dropped
     * to preserve memory and system stability.
     */
    log(entry: AuditEntry): void;
    /**
     * Log a denied access attempt.
     */
    logDenial(toolName: string, reason: string, context?: {
        user?: string | null;
        scopes?: string[];
        category?: AuditEntry['category'];
        scope?: string;
        requestId?: string;
        sessionId?: string;
    }): void;
    /**
     * Flush the buffer to disk.
     * Safe to call concurrently — serialises via `this.flushQueue` Promise chain.
     */
    flush(): Promise<void>;
    /**
     * Gracefully close the logger — flush remaining entries and stop the timer.
     */
    close(): Promise<void>;
    /**
     * Read the most recent audit entries from the log file.
     * Uses a streaming tail-read: only the last TAIL_READ_BYTES (64 KB) are
     * read from disk, preventing O(n) memory spikes for large audit logs.
     * Used by the `memory://audit` resource.
     *
     * @param count Maximum number of entries to return (default 50)
     */
    recent(count?: number): Promise<AuditEntry[]>;
    /**
     * Search across the active log and all rotated archives.
     * Reads files backward from newest to oldest up to the configured limit.
     */
    search(filters: AuditSearchFilters): Promise<AuditEntry[]>;
    /**
     * Ensure the parent directory of the log file exists.
     */
    private ensureDirectory;
    /**
     * Rotate the log file if it exceeds the configured size limit.
     * Keeps up to 5 rotated files (`.1` through `.5`); older data is discarded.
     * Rotation failure is non-fatal — audit must not block tool execution.
     */
    private rotateIfNeeded;
}
//# sourceMappingURL=audit-logger.d.ts.map