/**
 * DynamoDB Audit Logger for Visus-MCP
 * Activates the deployed but incomplete DynamoDB audit table.
 */
import type { AuditLogRecord, LawfulBasis } from './schema.js';
export declare const AUDIT_TTL_SECONDS: number;
/**
 * Details for building a RedactionRecord
 */
export interface RedactionDetail {
    category: string;
    pattern_id: string;
    original_length: number;
    replacement: string;
    risk_level?: 'low' | 'medium' | 'high' | 'critical';
    ai_act_article?: string;
    gdpr_article?: string;
}
/**
 * Writes structured audit records to DynamoDB with 90-day TTL.
 *
 * Designed for EU AI Act Art. 9 / Art. 13 / Art. 15 and GDPR Art. 30 / Art. 32
 * compliance documentation.
 *
 * Fail-open by default: if DynamoDB write fails, the MCP tool call still
 * returns its result. The error is logged to stderr for operational monitoring.
 * Deployers requiring fail-closed behaviour should set AUDIT_FAIL_CLOSED=true.
 */
export declare class AuditLogger {
    private tableName;
    private region;
    private failClosed;
    private enabled;
    private docClient;
    constructor();
    private getDocClient;
    /**
     * SHA-256(request_id + sorted_pattern_ids_joined + timestamp_utc)
     * Deterministic and verifiable without storing original content.
     */
    private computeProofHash;
    /**
     * SHA-256 of content. Used for integrity verification, not reconstruction.
     */
    private computeContentHash;
    /**
     * Extract and hash domain for privacy-preserving audit records.
     */
    private anonymiseDomain;
    /**
     * Construct a complete AuditLogRecord from sanitization pipeline outputs.
     * Call this immediately after sanitization completes, before returning to MCP caller.
     */
    buildRecord(params: {
        requestId: string;
        toolName: string;
        toolVersion: string;
        rawInput: string;
        sanitizedOutput: string;
        sourceUrl: string;
        patternsEvaluated: number;
        triggeredPatternIds: string[];
        redactionDetails: RedactionDetail[];
        processingDurationMs: number;
        success?: boolean;
        errorType?: string;
        lawfulBasis?: LawfulBasis;
        personalDataCategories?: string[];
        mcpServerVersion?: string;
        userId?: string;
    }): AuditLogRecord;
    /**
     * Write audit record to DynamoDB. Returns true on success, false on failure.
     * Never raises — failures are logged to stderr only (fail-open default).
     */
    write(record: AuditLogRecord): Promise<boolean>;
    /**
     * Synchronous write — use when not in async context.
     */
    writeSync(record: AuditLogRecord): Promise<boolean>;
    /**
     * Fire-and-forget write (do not await result)
     */
    writeFireAndForget(record: AuditLogRecord): void;
}
/**
 * Get the singleton audit logger instance
 */
export declare function getLogger(): AuditLogger;
//# sourceMappingURL=logger.d.ts.map