/**
 * Runtime permissions evaluator.
 *
 * Evaluates tool calls through a layered priority stack. First match wins.
 */
import type { PermissionDecision, PermissionMode, PermissionsConfig } from './types.js';
import type { BundleProvenance } from './policy-loader.js';
import { DecisionLog } from './decision-log.js';
/**
 * LayeredPolicyEvaluator, Core runtime permissions evaluator.
 *
 * Evaluates tool calls through five layers in priority order.
 * Maintains a session approval cache and a structured audit log.
 *
 * Usage:
 * ```ts
 * const evaluator = new LayeredPolicyEvaluator({ mode: 'default', rules: [] });
 * const decision = evaluator.evaluate('write', { path: '/tmp/out.txt' });
 * ```
 */
export declare class LayeredPolicyEvaluator {
    private readonly mode;
    private readonly rules;
    private readonly defaultEffect;
    private readonly projectRoot?;
    private readonly sessionCache;
    private sessionCacheInsertOrder;
    readonly log: DecisionLog;
    /** GC-PERM-011: Provenance from the loaded policy bundle, if any. */
    private readonly provenance?;
    private static readonly MAX_SESSION_CACHE_SIZE;
    constructor(config: PermissionsConfig, provenance?: BundleProvenance);
    /**
     * evaluate, Evaluates a tool call and returns a PermissionDecision.
     *
     * Runs all five layers in priority order. Populates a full evaluation trace.
     * Appends the decision to the audit log if `auditLog` is enabled (default: true).
     *
     * @param toolName, The tool name being called.
     * @param args    , The arguments passed to the tool.
     */
    evaluate(toolName: string, args: Record<string, unknown>): PermissionDecision;
    /**
     * recordSessionOverride, Records a user-provided session approval/denial
     * in the cache (used after a user prompt resolves).
     *
     * @param toolName , Tool name.
     * @param args     , Tool arguments.
     * @param approved , Whether the user approved or denied.
     * @param remember , Whether to persist for the session (default: false = once only).
     */
    recordSessionOverride(toolName: string, args: Record<string, unknown>, approved: boolean, remember?: boolean): void;
    /**
     * getMode, Returns the active PermissionMode.
     */
    getMode(): PermissionMode;
    private finalize;
    private getSessionKey;
}
//# sourceMappingURL=evaluator.d.ts.map