/**
 * Structured denial event logging.
 *
 * Replaces free-text "blocked" log messages in the tool policy pipeline and
 * security modules with typed DenialEvent records. Required by Sprint MM's
 * denial aggregation engine (denial-aggregator.ts).
 *
 * @module
 */
export type DenialEventType = "tool_policy" | "prompt_guard" | "leak_detector" | "egress" | "autonomy";
export interface DenialEvent {
    timestamp: string;
    type: DenialEventType;
    tool?: string;
    host?: string;
    reason: string;
    sessionId?: string;
    agentId?: string;
    severity: "info" | "warn" | "critical";
}
/**
 * Record a denial event. Appends to the in-memory ring buffer (capped at 500)
 * and emits a structured [DENIAL] log line.
 *
 * This ring buffer is consumed by denial-aggregator.ts (Sprint MM.1).
 */
export declare function recordDenial(event: Omit<DenialEvent, "timestamp">): DenialEvent;
/** Return the last N denial events (default: 50). */
export declare function recentDenials(n?: number): DenialEvent[];
/** Clear the denial ring buffer (primarily for testing). */
export declare function clearDenialRing(): void;
