/**
 * Multi-Tenant Cross-Tenant IDOR Challenge
 *
 * Source-level antagonist analysis for Broken Access Control (OWASP A01) —
 * specifically the cross-tenant data leak class that deterministic SAST
 * structurally cannot catch:
 *
 *   const userId = searchParams.get("userId");           // attacker-controlled
 *   getSupabaseAdmin().from("trades").eq("user_id", userId)  // RLS bypassed, no ownership check
 *
 * Flagging this requires reasoning about four app-specific facts at once
 * (privileged/RLS-bypassing client, tenant-boundary column, request-derived
 * filter value, no ownership assertion). We pre-filter candidate handlers
 * deterministically to bound LLM cost, then let the model confirm.
 *
 * @module agents/antagonist/multi-tenant-challenge
 */
import type { Finding } from "../../certification/types.js";
import type { AntagonistConfig, ChallengerAssessment } from "./types.js";
/** Thrown when the antagonist LLM response is missing or malformed. */
export declare class AntagonistError extends Error {
    constructor(message: string);
}
interface Candidate {
    /** Path relative to the project root. */
    file: string;
    content: string;
    /** 1-based line of the RLS-bypassing query (best primary location). */
    queryLine: number;
    hasOwnershipCheck: boolean;
}
/**
 * Deterministically pre-select handler files that exhibit all three
 * structural signals (privileged client, request source, filtered query).
 * The model decides whether the fourth fact (no ownership check) truly holds.
 */
export declare function findMultiTenantCandidates(projectPath: string): Promise<Candidate[]>;
/**
 * Run the multi-tenant cross-tenant IDOR analysis over a project's source.
 * Returns first-class findings (for consensus gating) plus challenger
 * assessments (for the antagonist report).
 */
export declare function analyzeMultiTenantCrossTenant(projectPath: string, config: AntagonistConfig): Promise<{
    findings: Finding[];
    assessments: ChallengerAssessment[];
    tokensUsed: number;
}>;
export {};
//# sourceMappingURL=multi-tenant-challenge.d.ts.map