/**
 * Denial Audit Log — Persistent structured record of all permission denials.
 *
 * Writes denial events to a JSONL file for post-session analysis,
 * compliance auditing, and permission calibration improvement.
 *
 * Storage layout:
 *   <project>/.qlogicagent/audit/denials.jsonl   (project-level)
 *   ~/.qlogicagent/audit/denials.jsonl            (user-level fallback)
 *
 * Each line is a self-contained JSON record with full context.
 * File is append-only; rotation handled externally if needed.
 */
export interface DenialAuditEntry {
    /** ISO 8601 timestamp */
    timestamp: string;
    /** Session identifier */
    sessionId: string;
    /** Turn identifier (if available) */
    turnId: string;
    /** Tool that was denied */
    toolName: string;
    /** Human-readable reason for denial */
    reason: string;
    /** Source of the denial decision */
    source: "classifier" | "rule-engine" | "user" | "timeout" | "safety" | "static-deny";
    /** Permission role at time of denial */
    permissionRole: string;
    /** Tool call ID */
    callId: string;
    /** Tool arguments (sanitized — no secrets) */
    toolArgs?: Record<string, unknown>;
    /** Cumulative denial count at this point */
    cumulativeDenials: number;
    /** Consecutive denial count at this point */
    consecutiveDenials: number;
}
export declare class DenialAuditLogger {
    private filePath;
    private writeQueue;
    constructor(projectRoot: string);
    /**
     * Append a denial event to the audit log.
     * Non-blocking; errors are swallowed to avoid disrupting agent flow.
     */
    record(entry: DenialAuditEntry): void;
    /** Get the audit log file path (for external tools/export). */
    getFilePath(): string;
    private doWrite;
}
/** Remove potential secrets from tool args before logging. */
export declare function sanitizeToolArgs(args: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
