/**
 * L4 Tenant Boundary Guard
 *
 * Enforces strict multi-tenant isolation.
 * Prevents cross-tenant data access.
 */
import { SessionContext, TenantBoundaryResult, GuardLogger } from "../types";
export interface ResourceOwnership {
    resource_id: string;
    tenant_id: string;
    resource_type?: string;
}
export interface TenantBoundaryConfig {
    validTenants?: Set<string>;
    resourceOwnership?: Map<string, ResourceOwnership>;
    resourceIdFields?: string[];
    listOperations?: string[];
    logger?: GuardLogger;
}
export declare class TenantBoundary {
    private validTenants;
    private resourceOwnership;
    private resourceIdFields;
    private listOperations;
    private logger;
    constructor(config?: TenantBoundaryConfig);
    /**
     * Validate session has valid tenant
     */
    validateSession(session: SessionContext | undefined, requestId?: string): {
        valid: boolean;
        error?: string;
    };
    /**
     * Check resource ownership
     */
    checkResourceOwnership(resourceId: string, session: SessionContext, requestId?: string): {
        allowed: boolean;
        resource_tenant?: string;
    };
    /**
     * Check if tenant_id parameter matches session
     */
    checkTenantParameter(params: Record<string, any>, session: SessionContext, requestId?: string): {
        allowed: boolean;
        reason?: string;
    };
    /**
     * Enforce tenant filtering for list operations
     */
    enforceTenantFilter(toolName: string, params: Record<string, any>, session: SessionContext, requestId?: string): {
        allowed: boolean;
        enforced_params: Record<string, any>;
        reason?: string;
    };
    /**
     * Complete tenant boundary check
     */
    check(toolName: string, params: Record<string, any>, session: SessionContext | undefined, requestId?: string): TenantBoundaryResult;
    /**
     * Register resource ownership
     */
    registerResource(resourceId: string, tenantId: string, resourceType?: string): void;
    /**
     * Add valid tenant
     */
    addValidTenant(tenantId: string): void;
}