/**
 * Session enforcement - require active sessions for write operations.
 *
 * Part of the Epic-Bound Session architecture. Enforces that write operations
 * (add, update, complete) require an active session.
 *
 * @task T4454
 * @epic T4454
 */
/** Enforcement modes. */
export type EnforcementMode = 'strict' | 'warn' | 'none';
/** Get the current enforcement mode. */
export declare function getEnforcementMode(cwd?: string): EnforcementMode;
/** Check if session enforcement is enabled. */
export declare function isSessionEnforcementEnabled(cwd?: string): boolean;
/** Session info for enforcement checks. */
export interface ActiveSessionInfo {
    id: string;
    name: string;
    scope: {
        type: string;
        epicId?: string;
    };
}
/** Get active session info. Returns null if no active session. */
export declare function getActiveSessionInfo(cwd?: string): Promise<ActiveSessionInfo | null>;
/** Enforcement result. */
export interface EnforcementResult {
    allowed: boolean;
    mode: EnforcementMode;
    session: ActiveSessionInfo | null;
    warning?: string;
}
/**
 * Require an active session for write operations.
 * In strict mode, throws if no session is active.
 * In warn mode, returns a warning but allows the operation.
 * In none mode, always allows.
 *
 * @param operation - Dot-delimited operation identifier (e.g. `"tasks.complete"`).
 * @param cwd - Project root override for config + session resolution.
 * @param remedyNote - Optional operation-specific remediation sentence appended
 *   to the thrown error's `fix` text (gh#1194 / T12106). Used by
 *   `tasks.complete` to make clear that gates already recorded via
 *   `cleo verify` are preserved and do NOT need re-verification — the recovery
 *   is "start a session, re-run complete", not "fix the evidence".
 */
export declare function requireActiveSession(operation: string, cwd?: string, remedyNote?: string): Promise<EnforcementResult>;
/**
 * Emit a loud NON-fatal warning when a session-free write operation (e.g.
 * `cleo verify`) records state without an active session while strict session
 * enforcement is in effect (gh#1194 / T12106).
 *
 * Session-free writes are intentional: T9505 keeps `cleo verify` usable
 * without a session so crash-recovery re-attestation works before a new
 * session is started — the write is NEVER blocked here. But `cleo complete`
 * DOES require an active session, so an agent that ended its session
 * mid-turn would otherwise discover the asymmetry only at complete time
 * (E_CLEO_SESSION_REQUIRED) after every gate already read green. Pushing the
 * warning into the envelope `meta.warnings[]` diagnostics channel keeps the
 * stdout JSON contract pure while surfacing the mismatch at verify time.
 *
 * Only fires under `strict` enforcement — in `warn`/`none` modes complete
 * will not reject the missing session, so the warning would be misleading.
 *
 * @param operation - Dot-delimited operation identifier (e.g. `"check.gate.set"`).
 * @param cwd - Project root override for config + session resolution.
 * @returns `true` when the warning was emitted (strict mode + no active session).
 *
 * @task T12106
 * @gh 1194
 */
export declare function warnIfNoActiveSession(operation: string, cwd?: string): Promise<boolean>;
/**
 * Validate that a task is within the current session's scope.
 * Only enforced when a session is active.
 */
export declare function validateTaskInScope(taskId: string, taskEpicId?: string, cwd?: string): Promise<{
    inScope: boolean;
    warning?: string;
}>;
//# sourceMappingURL=session-enforcement.d.ts.map