/**
 * Sync Audit Logger
 *
 * Logs all sync operations for compliance and debugging.
 * Uses JSONL format for efficient appending and querying.
 *
 * Features:
 * - JSONL format (one JSON object per line)
 * - Log rotation (new file when > 100MB or new day)
 * - Configurable retention
 *
 * @module core/sync/sync-audit-logger
 */
import { SyncPlatform } from '../types/sync-config.js';
import { SyncOperation } from './permission-enforcer.js';
import { Logger } from '../../utils/logger.js';
/**
 * Audit log entry - single sync operation record
 */
export interface AuditLogEntry {
    /**
     * ISO timestamp of the operation
     */
    timestamp: string;
    /**
     * Target platform
     */
    platform: SyncPlatform;
    /**
     * Operation type
     */
    operation: SyncOperation;
    /**
     * Item ID being operated on
     */
    itemId: string;
    /**
     * Operation result
     */
    result: 'success' | 'denied' | 'error';
    /**
     * Reason for denial (if denied)
     */
    reason?: string;
    /**
     * Error message (if error)
     */
    error?: string;
    /**
     * Duration of the operation in milliseconds
     */
    durationMs?: number;
    /**
     * Additional context
     */
    context?: Record<string, unknown>;
    /**
     * Sync direction: push (to external) or pull (from external)
     */
    direction?: 'push' | 'pull';
    /**
     * Who made the change in the external tool (for pull)
     */
    externalChangedBy?: string;
    /**
     * When the change was made in the external tool (for pull)
     */
    externalChangedAt?: string;
    /**
     * Old value before the change
     */
    oldValue?: unknown;
    /**
     * New value after the change
     */
    newValue?: unknown;
    /**
     * How the conflict was resolved
     */
    conflictResolution?: 'local-wins' | 'external-wins' | 'no-conflict';
}
/**
 * Audit logger options
 */
export interface SyncAuditLoggerOptions {
    /**
     * Path to .specweave directory
     */
    specweavePath?: string;
    /**
     * Logger instance
     */
    logger?: Logger;
    /**
     * Max file size in bytes before rotation
     * @default 104857600 (100MB)
     */
    maxFileSizeBytes?: number;
    /**
     * Retention period in days
     * @default 30
     */
    retentionDays?: number;
    /**
     * Enable logging (can be disabled for testing)
     * @default true
     */
    enabled?: boolean;
}
/**
 * SyncAuditLogger - Comprehensive audit logging for sync operations
 *
 * All sync attempts are logged including:
 * - Successful operations
 * - Permission denials
 * - Errors during execution
 *
 * Logs are stored in JSONL format for easy parsing:
 * `.specweave/logs/sync/audit-YYYY-MM-DD.jsonl`
 *
 * Usage:
 * ```typescript
 * const logger = new SyncAuditLogger({ specweavePath });
 *
 * await logger.logSuccess('github', 'upsert-internal', 'FS-001', 150);
 * await logger.logDenied('jira', 'upsert-external', 'EXT-123', 'External updates disabled');
 * await logger.logError('ado', 'update-status', 'US-456', new Error('Network timeout'));
 * ```
 */
export declare class SyncAuditLogger {
    private readonly logDir;
    private readonly logger;
    private readonly maxFileSizeBytes;
    private readonly retentionDays;
    private readonly enabled;
    private currentDate;
    private currentFilePath;
    constructor(options?: SyncAuditLoggerOptions);
    /**
     * Log a successful sync operation
     *
     * @param platform - Target platform
     * @param operation - Operation type
     * @param itemId - Item ID
     * @param durationMs - Operation duration in milliseconds
     * @param context - Optional additional context
     */
    logSuccess(platform: SyncPlatform, operation: SyncOperation, itemId: string, durationMs?: number, context?: Record<string, unknown>): Promise<void>;
    /**
     * Log a denied sync operation
     *
     * @param platform - Target platform
     * @param operation - Operation type
     * @param itemId - Item ID
     * @param reason - Denial reason
     * @param context - Optional additional context
     */
    logDenied(platform: SyncPlatform, operation: SyncOperation, itemId: string, reason: string, context?: Record<string, unknown>): Promise<void>;
    /**
     * Log an error during sync operation
     *
     * @param platform - Target platform
     * @param operation - Operation type
     * @param itemId - Item ID
     * @param error - Error that occurred
     * @param context - Optional additional context
     */
    logError(platform: SyncPlatform, operation: SyncOperation, itemId: string, error: Error, context?: Record<string, unknown>): Promise<void>;
    /**
     * Log a pull sync operation (Increment 0089)
     *
     * @param platform - Source platform
     * @param operation - Operation type
     * @param itemId - Item ID
     * @param pullData - Pull-specific data
     */
    logPull(platform: SyncPlatform, operation: SyncOperation, itemId: string, pullData: {
        externalChangedBy: string;
        externalChangedAt: string;
        oldValue?: unknown;
        newValue?: unknown;
        conflictResolution?: 'local-wins' | 'external-wins' | 'no-conflict';
        durationMs?: number;
    }): Promise<void>;
    /**
     * Log a pull sync conflict resolution (Increment 0089)
     *
     * @param platform - Source platform
     * @param itemId - Item ID
     * @param resolution - How the conflict was resolved
     * @param details - Additional conflict details
     */
    logPullConflict(platform: SyncPlatform, itemId: string, resolution: 'local-wins' | 'external-wins', details: {
        field: string;
        localValue: unknown;
        externalValue: unknown;
        localTimestamp?: string;
        externalTimestamp?: string;
        reason: string;
    }): Promise<void>;
    /**
     * Get pull sync entries (Increment 0089)
     *
     * @param limit - Maximum entries
     */
    getPullEntries(limit?: number): Promise<AuditLogEntry[]>;
    /**
     * Get log file path for a specific date
     *
     * @param date - Date to get log path for (defaults to today)
     */
    getLogPath(date?: Date): string;
    /**
     * Get all log files in the log directory
     *
     * @returns Array of log file paths sorted by date (newest first)
     */
    getLogFiles(): Promise<string[]>;
    /**
     * Read log entries from a file
     *
     * @param filePath - Path to log file
     * @param limit - Maximum entries to return
     * @param filter - Optional filter function
     */
    readEntries(filePath: string, limit?: number, filter?: (entry: AuditLogEntry) => boolean): Promise<AuditLogEntry[]>;
    /**
     * Get recent log entries across all log files
     *
     * @param limit - Maximum entries to return
     * @param filter - Optional filter function
     */
    getRecentEntries(limit?: number, filter?: (entry: AuditLogEntry) => boolean): Promise<AuditLogEntry[]>;
    /**
     * Get entries for a specific platform
     *
     * @param platform - Platform to filter by
     * @param limit - Maximum entries
     */
    getEntriesForPlatform(platform: SyncPlatform, limit?: number): Promise<AuditLogEntry[]>;
    /**
     * Get all denied entries (for monitoring)
     *
     * @param limit - Maximum entries
     */
    getDeniedEntries(limit?: number): Promise<AuditLogEntry[]>;
    /**
     * Get all error entries (for debugging)
     *
     * @param limit - Maximum entries
     */
    getErrorEntries(limit?: number): Promise<AuditLogEntry[]>;
    /**
     * Get statistics for a time period
     */
    getStats(since?: Date): Promise<{
        total: number;
        success: number;
        denied: number;
        errors: number;
        byPlatform: Record<SyncPlatform, number>;
        avgDurationMs: number;
    }>;
    /**
     * Clean up old log files based on retention policy
     */
    cleanup(): Promise<number>;
    /**
     * Write an entry to the log file
     */
    private log;
    /**
     * Get current file path, rotating if needed
     */
    private getOrRotateFilePath;
    /**
     * Find the next available rotated file path
     */
    private findNextRotatedPath;
}
//# sourceMappingURL=sync-audit-logger.d.ts.map