/**
 * Policy gate engine — the {@link checkGate} entry point.
 *
 * Given a configured {@link VaultPolicy}, an active session tier, and
 * the factor proofs an actor is presenting, decide whether the gate
 * permits the action. On denial, throws {@link PolicyDeniedError} with
 * a stable {@link PolicyDenyReason} so consumers can branch in error
 * UIs.
 *
 * @see https://github.com/vLannaAi/noy-db-docs/blob/main/content/docs/services/session-tiers.md → checkGate() API
 *
 * @module
 */
import { type PolicyDenyReason } from '../../kernel/errors.js';
import type { ActiveTier, FactorProof, GateName, GatePolicy, VaultPolicy } from '../../kernel/types.js';
/** Default freshness window — 5 minutes. */
export declare const DEFAULT_FRESHNESS_MS: number;
/** Caller-supplied context for one `checkGate` invocation. */
export interface CheckGateContext {
    /** Tier the active session currently holds. */
    readonly activeTier: ActiveTier;
    /** Proofs the actor is presenting for this gate. */
    readonly factors?: ReadonlyArray<FactorProof>;
    /**
     * If the host knows the actor is on a shared device, set this to
     * `true` so the engine can apply `warn.sharedDevice` rules. Defaults
     * to `false`.
     */
    readonly sharedDevice?: boolean;
    /**
     * Override `now()` for tests. Defaults to `Date.now()`.
     * @internal
     */
    readonly now?: number;
}
/**
 * Decide whether `gate` permits the action under `context`. Throws
 * {@link PolicyDeniedError} on denial; resolves with `void` on success.
 *
 * Lookup rules:
 * - **Built-in gates** without a configured policy fail closed
 *   (`enabled: false`).
 * - **App-defined gates** (`app:*`) without a configured policy are
 *   treated as no-op (allow). The developer registered the policy if
 *   they wanted enforcement; absence means the gate is informational.
 */
export declare function checkGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise<void>;
/**
 * Same as {@link checkGate} but returns a structured verdict instead
 * of throwing. Useful when an error UI wants to show the user
 * "you'll need TOTP plus a recovery code to do that" without first
 * triggering the action.
 */
export declare function describeGate(policy: VaultPolicy, gate: GateName, context: CheckGateContext): Promise<{
    ok: true;
} | {
    ok: false;
    reason: PolicyDenyReason;
    required: GatePolicy;
}>;