/**
 * Agent audit log — append-only JSONL with size-based rotation.
 *
 * Every gated tool call writes a row. Rows deliberately carry NO argument
 * values and NO response bodies — the agent already saw both, and logging
 * them would create a parallel on-disk copy of the user's email. We store
 * a truncated sha256 hash of the args instead so "same call repeated" is
 * observable without content leakage.
 *
 * File: ~/.mailpouch-agent-audit.jsonl (0600)
 * Rotation: when current file exceeds ROTATE_BYTES, rename to .1.gz and
 *           start fresh. Keep KEEP_GENERATIONS compressed generations.
 */
import type { AuditRow } from "./types.js";
export interface AuditDeps {
    /** Absolute path to the active log file. */
    path: string;
    /** Now() override for deterministic tests. */
    now?: () => number;
}
export declare class AgentAuditLog {
    private readonly path;
    private readonly now;
    constructor(deps: AuditDeps);
    /** Append a row. Best-effort — logging failures are warned, not thrown. */
    write(row: AuditRow): void;
    private rotateIfNeeded;
    /**
     * Read the last `limit` rows. Used by the (forthcoming) Log UI tab.
     * Cheap for typical sizes because the file is append-only JSONL; for
     * very large logs consider tailing with a seek, but we're at most 10 MB
     * so a full load + slice is fine.
     */
    readTail(limit?: number): AuditRow[];
}
/**
 * Truncated sha256 of JSON.stringify(args). Gives us a stable "same args"
 * fingerprint without storing the content. 16 hex chars = 64 bits of
 * collision resistance, plenty for a dedup hint at mailpouch scale.
 */
export declare function hashArgs(args: unknown): string;
//# sourceMappingURL=audit.d.ts.map