/**
 * Tamper-evident audit log for PII detection events (in-memory only).
 *
 * Logs what was detected (category, count, timestamp) WITHOUT storing real values.
 * Uses HMAC chaining for tamper evidence -- each log entry includes a hash of
 * the previous entry, so any modification/deletion is detectable.
 */
import { DetectedEntity } from "./types.js";
export interface AuditEntry {
    timestamp: number;
    timestampIso: string;
    eventType: string;
    sessionId: string;
    requestId: string;
    categories: Record<string, number>;
    totalEntities: number;
    textLength: number;
    processingTimeMs: number;
    chainHash: string;
}
export declare class AuditLogger {
    private readonly _secret;
    private readonly _sessionId;
    private readonly _maxEntries;
    private _lastHash;
    private _entries;
    private _stats;
    constructor(secretKey: string, maxEntries?: number);
    /** Generate a unique request ID. */
    static generateRequestId(): string;
    /** Log an obfuscation event (no real values stored). */
    logObfuscation(entities: DetectedEntity[], textLength: number, requestId?: string, processingTimeMs?: number): void;
    /** Log a deobfuscation event. */
    logDeobfuscation(replacementsMade: number, requestId?: string, processingTimeMs?: number): void;
    private _writeEntry;
    /** Return aggregate statistics (safe to expose). */
    getStats(): object;
    /**
     * Verify the integrity of the audit log chain.
     * Returns { valid, entriesChecked }.
     */
    verifyChain(): {
        valid: boolean;
        entriesChecked: number;
    };
}