/**
 * Guard Definitions for Tenant Isolation Rules
 *
 * Guards are security controls that prevent unsafe data flows.
 * A finding is only raised if required guards are missing.
 *
 * DETECTION METHOD: Pattern-based string matching on AST nodes.
 *
 * LIMITATIONS (documented for transparency):
 * - Detection is substring matching, not semantic analysis
 * - Aliased imports won't be detected (e.g., `z.parse` vs `zod.parse`)
 * - Custom validation functions won't be detected
 * - No data flow tracking through guard application
 *
 * KNOWN FALSE NEGATIVES:
 * - Custom validation wrappers
 * - Aliased library imports
 * - Validation in separate utility files
 *
 * KNOWN FALSE POSITIVES:
 * - Guard detected but not on the vulnerable path
 * - Guard present but incorrectly implemented
 */
export declare const TENANT_ISOLATION_GUARDS: readonly ["tenantId", "organizationId", "workspaceId", "tenant_filter", "org_filter", "namespace", "tenant_scope", "row_level_security", "rls", "orgId", "tenant_id"];
export declare const AUTHENTICATION_GUARDS: readonly ["auth()", "getServerSession", "getSession", "verifyToken", "requireAuth", "authenticate", "isAuthenticated", "checkAuth", "jwt.verify", "session.user", "requireOrganizationAccess", "requireTenantAccess"];
export declare const AUTHORIZATION_GUARDS: readonly ["checkPermission", "hasRole", "hasPermission", "authorize", "rbac", "acl", "can()", "ability.can", "policy.authorize"];
export declare const MCP_TOOL_VISIBILITY_GUARDS: readonly ["tenantTools", "allowedTools", "toolAllowlist", "toolVisibility", "tenantToolFilter", "toolScope", "visibleTools", "enabledTools"];
export declare const MCP_CACHE_PREFIX_GUARDS: readonly ["tenantPrefix", "cachePrefix", "keyPrefix", "namespacePrefix", "tenantCacheKey", "scopedCacheKey"];
export declare const MCP_SESSION_BINDING_GUARDS: readonly ["session.userId", "session.tenantId", "session.organizationId", "boundToUser", "boundToTenant", "sessionBinding", "userTenantBinding"];
export declare const MCP_CREDENTIAL_VAULT_GUARDS: readonly ["tenantCredentials", "scopedCredentials", "tenantToken", "perTenantToken", "credentialScope", "vaultNamespace"];
export declare const MCP_RATE_LIMIT_GUARDS: readonly ["tenantRateLimit", "perTenantLimit", "rateLimitByTenant", "tenantThrottle"];
export declare const MCP_VECTOR_STORE_GUARDS: readonly ["tenantNamespace", "vectorNamespace", "tenantCollection", "scopedIndex", "tenantPartition"];
export declare const MCP_FILESYSTEM_GUARDS: readonly ["tenantRoot", "tenantDir", "scopedRoot", "tenantPath", "sandboxPath"];
export declare const ALL_GUARDS: readonly ["tenantId", "organizationId", "workspaceId", "tenant_filter", "org_filter", "namespace", "tenant_scope", "row_level_security", "rls", "orgId", "tenant_id", "auth()", "getServerSession", "getSession", "verifyToken", "requireAuth", "authenticate", "isAuthenticated", "checkAuth", "jwt.verify", "session.user", "requireOrganizationAccess", "requireTenantAccess", "checkPermission", "hasRole", "hasPermission", "authorize", "rbac", "acl", "can()", "ability.can", "policy.authorize", "tenantTools", "allowedTools", "toolAllowlist", "toolVisibility", "tenantToolFilter", "toolScope", "visibleTools", "enabledTools", "tenantPrefix", "cachePrefix", "keyPrefix", "namespacePrefix", "tenantCacheKey", "scopedCacheKey", "session.userId", "session.tenantId", "session.organizationId", "boundToUser", "boundToTenant", "sessionBinding", "userTenantBinding", "tenantCredentials", "scopedCredentials", "tenantToken", "perTenantToken", "credentialScope", "vaultNamespace", "tenantRateLimit", "perTenantLimit", "rateLimitByTenant", "tenantThrottle", "tenantNamespace", "vectorNamespace", "tenantCollection", "scopedIndex", "tenantPartition", "tenantRoot", "tenantDir", "scopedRoot", "tenantPath", "sandboxPath"];
export declare const GUARDS_BY_CATEGORY: Record<string, readonly string[]>;
export declare function hasGuard(code: string, guards: readonly string[]): boolean;
export declare function findMissingGuards(code: string, requiredGuards: readonly string[]): string[];
export declare function findPresentGuards(code: string, guards: readonly string[]): string[];
//# sourceMappingURL=guards.d.ts.map