/**
 * auditLog.ts — Security audit trail for tool execution.
 *
 * Logs all security-relevant events (path checks, command execution,
 * URL validation, credential redactions) to SQLite.
 */
export interface AuditEntry {
    id: string;
    timestamp: string;
    category: "path" | "exec" | "url" | "secret" | "tool_call";
    toolName: string;
    argsPreview: string;
    allowed: boolean;
    reason?: string;
    metadata?: Record<string, unknown>;
}
/**
 * Log a security audit event.
 *
 * Non-blocking — buffers writes and flushes every 100ms.
 */
export declare function auditLog(category: AuditEntry["category"], toolName: string, argsPreview: string, allowed: boolean, reason?: string, metadata?: Record<string, unknown>): void;
/**
 * Query the audit log.
 */
export declare function getAuditLog(opts?: {
    category?: AuditEntry["category"];
    toolName?: string;
    since?: string;
    limit?: number;
    onlyBlocked?: boolean;
}): AuditEntry[];
/** Force flush — use before process exit */
export declare function flushAuditLog(): void;
/** Test helper */
export declare function _resetAuditForTesting(): void;
