/**
 * Lemma Gatekeeper
 *
 * Picks the correct cache backend per request based on license tier:
 *   Standard (Free) → InMemoryExactBackend (exact-match, no embeddings)
 *   Pro (Paid)      → SemanticBackendAdapter (vector similarity)
 *
 * Backend is evaluated per-request so activate takes effect immediately.
 * Emits 'mode-changed' when the effective tier switches.
 */
import { EventEmitter } from 'events';
import { KeyManager } from './KeyManager';
export type CacheMode = 'standard' | 'pro';
export interface GatekeeperStatus {
    mode: CacheMode;
    semanticEnabled: boolean;
    isPro: boolean;
    licenseKey: string | null;
}
export type InferenceMode = 'cloud' | 'hybrid' | 'airgapped';
export interface EgressDecision {
    allowed: boolean;
    mode: InferenceMode;
    host: string;
    reason: string;
}
export declare class EgressBlockedError extends Error {
    readonly decision: EgressDecision;
    code: "EGRESS_BLOCKED";
    constructor(decision: EgressDecision);
}
export interface CacheBackend {
    set(key: string, input: string, data: any, ttl: number): Promise<void>;
    findSimilar(input: string, threshold: number): Promise<{
        data: any;
        similarity: number;
    } | null>;
    size(): number;
    clear(): void;
}
export declare class Gatekeeper extends EventEmitter {
    private keyManager;
    private lastMode;
    private memBackend;
    private semBackend;
    private semInitialized;
    private inferenceMode;
    private allowedEndpoints;
    constructor(keyManager: KeyManager);
    private loadInferencePolicy;
    getInferenceStatus(): {
        mode: InferenceMode;
        allowedEndpoints: string[];
    };
    /**
     * Central egress decision. Called once per outbound provider request from
     * lemma-proxy.ts — no call site talks to a provider without going through this.
     */
    checkEgress(urlOrHost: string): EgressDecision;
    /**
     * Throws EgressBlockedError on denial, and emits 'egress-blocked' so callers
     * (e.g. the audit/token_receipt log) can record the attempt for compliance.
     */
    assertEgressAllowed(urlOrHost: string): void;
    getBackend(): Promise<CacheBackend>;
    getMode(): CacheMode;
    getStatus(): GatekeeperStatus;
    reload(): void;
    private getMemoryBackend;
    private getSemanticBackend;
}
//# sourceMappingURL=Gatekeeper.d.ts.map