import {
  detectRecallAnomalies
} from "./chunk-RFYAYKTD.js";
import {
  appendRecallAuditEntry
} from "./chunk-LBLXEFWK.js";

// src/access-audit.ts
var AccessAuditAdapter = class {
  constructor(config) {
    this.config = config;
    const n = config.trailBufferSize;
    if (typeof n === "number" && Number.isFinite(n) && n > 0) {
      const floored = Math.floor(n);
      this.trailBufferSize = floored >= 1 ? floored : 256;
    } else {
      this.trailBufferSize = 256;
    }
  }
  config;
  trails = /* @__PURE__ */ new Map();
  trailBufferSize;
  /**
   * Record an audit entry and (when enabled) run the anomaly detector
   * over the principal's tail of entries. The principal key is used
   * purely for tail-buffer bucketing — it need not match the production
   * namespace resolver; sessionKey is the safe default.
   */
  async record(principalKey, entry, now = Date.now()) {
    const result = {};
    if (this.config.detection.enabled) {
      const key = principalKey.length > 0 ? principalKey : "__anonymous__";
      const tail = this.trails.get(key) ?? { entries: [] };
      tail.entries.push(entry);
      if (tail.entries.length > this.trailBufferSize) {
        tail.entries.splice(0, tail.entries.length - this.trailBufferSize);
      }
      this.trails.set(key, tail);
      result.anomalies = detectRecallAnomalies({
        entries: tail.entries,
        now,
        config: this.config.detection
      });
    }
    if (this.config.audit.enabled) {
      try {
        result.appendedAt = await appendRecallAuditEntry(
          this.config.audit.rootDir,
          entry
        );
      } catch {
      }
    }
    return result;
  }
  /** Clear all in-memory tail state. Intended for tests / before_reset. */
  reset() {
    this.trails.clear();
  }
};

export {
  AccessAuditAdapter
};
//# sourceMappingURL=chunk-TVVEYCNW.js.map