/**
 * Layer 4 owner-override authentication system (T1118).
 *
 * Implements the four sublayers:
 *
 * - L4a: Session HMAC token — override requires a valid HMAC-SHA256 token
 *         derived from session_id + password, stored in sessions.owner_auth_token.
 * - L4b: CLEO_AGENT_ROLE fence — override is forbidden for worker|lead|subagent roles.
 *         Environment hash is captured at bootstrap; mutations are detected.
 * - L4c: TTY requirement — override call requires stdin + stderr to be TTYs.
 * - L4d: Rate limit + webhook — max N overrides per session; every use appended to
 *         force-bypass.jsonl with correct agent_id + session_id; optional webhook POST.
 *
 * @task T1118
 * @task T1123
 * @adr ADR-055
 */
import type { OwnerOverrideAuditRecord } from '@cleocode/contracts';
/**
 * Check if the current process is running as a restricted agent role.
 *
 * Re-reads process.env to detect mutation attempts and compares against
 * the bootstrapped snapshot.
 *
 * @returns true when the process has a restricted role and override is forbidden.
 *
 * @task T1118
 * @task T1123
 */
export declare function isAgentRoleForbidden(): boolean;
/**
 * Derive a session owner-auth HMAC token from session ID and password.
 *
 * Uses HMAC-SHA256(key=password, data=sessionId). The token is hex-encoded
 * and stored in sessions.owner_auth_token. Override callers must present
 * the same token via --auth-token.
 *
 * @param sessionId - Active session ID.
 * @param password - Plaintext password provided by the owner via TTY.
 * @returns Hex-encoded HMAC token.
 *
 * @task T1118
 * @task T1123
 */
export declare function deriveOwnerAuthToken(sessionId: string, password: string): string;
/**
 * Verify a caller-supplied auth token against the stored token.
 *
 * Uses a constant-time comparison to prevent timing attacks.
 *
 * @param callerToken - Token supplied by the caller via --auth-token.
 * @param storedToken - Token stored in sessions.owner_auth_token.
 * @returns true when tokens match.
 *
 * @task T1118
 * @task T1123
 */
export declare function verifyOwnerAuthToken(callerToken: string, storedToken: string): boolean;
/**
 * Check that stdin and stderr are both connected to a TTY.
 *
 * Override requires interactive use — piped or agent-driven invocations
 * are rejected at this gate.
 *
 * @returns true when both TTY checks pass.
 *
 * @task T1118
 * @task T1123
 */
export declare function isTtyPresent(): boolean;
/**
 * Default maximum number of overrides allowed per session.
 * Can be overridden via config.owner.overrideMaxPerSession.
 */
export declare const DEFAULT_OVERRIDE_MAX_PER_SESSION = 3;
/**
 * Record an override use and check against the session rate limit.
 *
 * @param sessionId - Active session ID (use "global" when no session).
 * @param maxPerSession - Maximum overrides allowed per session.
 * @returns true when within the rate limit, false when exceeded.
 *
 * @task T1118
 * @task T1123
 */
export declare function recordAndCheckOverrideLimit(sessionId: string, maxPerSession?: number): boolean;
/**
 * Get the current override count for a session.
 *
 * @param sessionId - Session ID to query.
 * @returns Current override count.
 *
 * @task T1118
 * @task T1123
 */
export declare function getOverrideCount(sessionId: string): number;
/**
 * Reset the override counter for a session (called on session end).
 *
 * @param sessionId - Session ID to reset.
 *
 * @task T1118
 * @task T1123
 */
export declare function resetOverrideCount(sessionId: string): void;
/**
 * Append an owner-override audit record to force-bypass.jsonl.
 *
 * Errors are swallowed — audit writes must never block the operation.
 * Matches the existing pattern in gate-audit.ts.
 *
 * @param projectRoot - Absolute path to the project root.
 * @param record - Audit record to append.
 *
 * @task T1118
 * @task T1123
 */
export declare function appendOwnerOverrideAudit(projectRoot: string, record: OwnerOverrideAuditRecord): void;
/**
 * POST an owner-override event to the configured alert webhook.
 *
 * Best-effort: network failures are silently ignored to avoid blocking
 * the protected operation.
 *
 * @param webhookUrl - HTTP(S) URL to POST the event to.
 * @param record - Override audit record to include in the payload.
 *
 * @task T1118
 * @task T1123
 */
export declare function deliverOverrideWebhook(webhookUrl: string, record: OwnerOverrideAuditRecord): Promise<boolean>;
/** Result of the L4 override validation. */
export interface OverrideValidationResult {
    /** Whether the override is permitted. */
    allowed: boolean;
    /** Error code if not allowed. */
    errorCode?: string;
    /** Human-readable error message. */
    errorMessage?: string;
}
/**
 * Validate all four L4 sublayers before permitting an owner override.
 *
 * Steps:
 * 1. L4b — Check agent role fence.
 * 2. L4c — Check TTY presence.
 * 3. L4a — Verify HMAC token (if storedToken provided).
 * 4. L4d — Check rate limit.
 *
 * @param opts - Validation options.
 * @returns Validation result.
 *
 * @task T1118
 * @task T1123
 */
export declare function validateOwnerOverride(opts: {
    sessionId: string;
    callerToken?: string;
    storedToken?: string;
    maxPerSession?: number;
    skipTtyCheck?: boolean;
    skipTokenCheck?: boolean;
}): OverrideValidationResult;
//# sourceMappingURL=owner-override-auth.d.ts.map