/**
 * OperatorRoles -- User-level RBAC for governance operations.
 *
 * Three roles: ADMIN, OPERATOR, VIEWER
 *   - ADMIN: Full access (configure, approve, modify governance)
 *   - OPERATOR: Run agents, view logs, submit approvals
 *   - VIEWER: Read-only access to logs and reports
 *
 * Required by:
 *   - HIPAA 164.312(a)(1): Access control
 *   - SOC 2 CC6.1: Logical access
 *   - ISO 27001 A.9.2: User access management
 *   - PCI DSS Req 7: Restrict access by business need
 *
 * @connexum/ai-governance
 */
export type Role = 'ADMIN' | 'OPERATOR' | 'VIEWER';
export interface Operator {
    /** Unique operator ID */
    id: string;
    /** Display name */
    name: string;
    /** Role */
    role: Role;
    /** When the operator was created */
    createdAt: string;
    /** Last activity timestamp */
    lastActiveAt?: string;
    /** Whether the operator is active */
    active: boolean;
    /** Optional metadata */
    metadata?: Record<string, unknown>;
}
export interface OperatorRolesConfig {
    /** Directory for operator data */
    operatorsDir: string;
    /** Session timeout in ms (default: 900000 = 15 min for HIPAA) */
    sessionTimeoutMs?: number;
}
export interface PermissionCheck {
    allowed: boolean;
    operator: string;
    role: Role;
    action: string;
    reason: string;
}
export declare class OperatorRoles {
    private config;
    private operators;
    private sessions;
    private operatorsFile;
    constructor(config: OperatorRolesConfig);
    /**
     * Create a new operator.
     */
    createOperator(name: string, role: Role, metadata?: Record<string, unknown>): Operator;
    /**
     * Get an operator by ID.
     */
    getOperator(operatorId: string): Operator | null;
    /**
     * List all operators.
     */
    listOperators(): Operator[];
    /**
     * Update an operator's role.
     */
    updateRole(operatorId: string, newRole: Role): Operator;
    /**
     * Deactivate an operator.
     */
    deactivate(operatorId: string): void;
    /**
     * Start a session for an operator. Returns session token.
     */
    startSession(operatorId: string): string;
    /**
     * Validate a session token. Returns operator ID if valid.
     */
    validateSession(token: string): string | null;
    /**
     * End a session.
     */
    endSession(token: string): void;
    /**
     * Check if an operator has permission to perform an action.
     */
    checkPermission(operatorId: string, action: string): PermissionCheck;
    /**
     * Get all permissions for a role.
     */
    getRolePermissions(role: Role): string[];
    /**
     * Get active session count.
     */
    getActiveSessionCount(): number;
    private saveOperators;
    private loadOperators;
}
//# sourceMappingURL=operator-roles.d.ts.map