import { RecallAuditEntry } from './recall-audit.js';
import { AnomalyDetectorConfig, AnomalyDetectorResult } from './recall-audit-anomaly.js';

/**
 * Access-layer audit adapter (issue #565 PR 5/5).
 *
 * Wraps `appendRecallAuditEntry` + `detectRecallAnomalies` into a single
 * entry point that MCP (`access-mcp.ts`) and HTTP (`access-http.ts`)
 * surfaces can call once per recall. Closes the gap called out in the
 * memory-extraction threat model §5: recall-audit previously only ran
 * on the Openclaw hook, so MCP/HTTP callers bypassed the trail entirely.
 *
 * The adapter is a per-instance class so the tail-of-trail buffer
 * (used by the anomaly detector) is scoped per-service, not global.
 *
 * No I/O unless `audit.enabled` is true; no detector invocation unless
 * `detection.enabled` is true. Either flag may be enabled independently.
 */

interface AccessAuditConfig {
    audit: {
        enabled: boolean;
        /** Root directory the audit adapter writes JSONL shards into. */
        rootDir: string;
    };
    detection: AnomalyDetectorConfig;
    /**
     * How many entries the adapter retains in memory for the detector.
     * Defaults to 256 — enough to cover the threat model's default 5-minute
     * window at high recall rates without unbounded growth.
     */
    trailBufferSize?: number;
}
interface AccessAuditResult {
    /** Path of the JSONL shard the entry was appended to (only when audit enabled). */
    appendedAt?: string;
    /** Result of the anomaly detector (only when detection enabled). */
    anomalies?: AnomalyDetectorResult;
}
declare class AccessAuditAdapter {
    private readonly config;
    private readonly trails;
    private readonly trailBufferSize;
    constructor(config: AccessAuditConfig);
    /**
     * Record an audit entry and (when enabled) run the anomaly detector
     * over the principal's tail of entries. The principal key is used
     * purely for tail-buffer bucketing — it need not match the production
     * namespace resolver; sessionKey is the safe default.
     */
    record(principalKey: string, entry: RecallAuditEntry, now?: number): Promise<AccessAuditResult>;
    /** Clear all in-memory tail state. Intended for tests / before_reset. */
    reset(): void;
}

export { AccessAuditAdapter, type AccessAuditConfig, type AccessAuditResult };
