/**
 * L3 Policy Gate
 *
 * Enforces role-based access control with constraint validation.
 * The definitive layer for authorization decisions.
 */
import { SessionContext, ToolDefinition, PolicyGateResult, Role, GuardLogger } from "../types";
export interface PolicyGateConfig {
    roleHierarchy?: Record<Role, number>;
    toolPermissions?: Map<string, {
        roles: Role[];
        constraints?: Record<Role, any>;
    }>;
    logger?: GuardLogger;
}
export declare class PolicyGate {
    private roleHierarchy;
    private toolPermissions;
    private logger;
    constructor(config?: PolicyGateConfig);
    /**
     * Validate session is authentic
     */
    validateSession(session: SessionContext | undefined, requestId?: string): {
        valid: boolean;
        error?: string;
    };
    /**
     * Detect role tampering (claimed vs session role)
     */
    detectRoleTampering(session: SessionContext, claimedRole: Role | undefined): {
        tampered: boolean;
        actual: Role;
        claimed?: Role;
    };
    /**
     * Check tool access for a session
     */
    checkToolAccess(tool: ToolDefinition, session: SessionContext, requestId?: string): {
        allowed: boolean;
        reason?: string;
    };
    /**
     * Check constraints for a tool call
     */
    checkConstraints(tool: ToolDefinition, params: Record<string, any>, session: SessionContext, requestId?: string): {
        valid: boolean;
        violations: string[];
    };
    /**
     * Complete policy check
     */
    check(tool: ToolDefinition, params: Record<string, any>, session: SessionContext | undefined, claimedRole: Role | undefined, requestId?: string): PolicyGateResult;
    /**
     * Set role hierarchy
     */
    setRoleHierarchy(hierarchy: Record<Role, number>): void;
}