export interface PolicyCheckResult {
    allowed: boolean;
    policyId: string;
    policyName: string;
    level: string;
    reason: string;
}
export interface GateResult {
    allowed: boolean;
    checks: PolicyCheckResult[];
    blockedBy: PolicyCheckResult[];
}
export declare class PolicyViolationError extends Error {
    checks: PolicyCheckResult[];
    constructor(message: string, checks: PolicyCheckResult[]);
}
/**
 * PolicyGate is the enforcement middleware.
 * Every tool call passes through executeWithGates() which:
 * 1. Retrieves all REQUIRED policies relevant to the operation
 * 2. Evaluates each policy's rules against the operation
 * 3. Blocks execution if any REQUIRED policy denies it
 * 4. Logs every check to the audit trail
 */
export declare class PolicyGate {
    private _memory;
    private _db;
    private _executionCount;
    private static readonly PRUNE_INTERVAL;
    private _cachedPolicies;
    private _cachedRules;
    private _cacheTimestamp;
    private static readonly CACHE_TTL_MS;
    private get memory();
    private get db();
    /** Invalidate the policy cache (call after policy upsert/update/toggle) */
    invalidateCache(): void;
    /** Get policies from cache or reload from DB */
    private getCachedPolicies;
    /** Get extracted rules for a policy, cached by policy ID */
    private getCachedRules;
    /**
     * Detect if an operation is related to task completion.
     */
    private isTaskCompletionOperation;
    /**
     * Check all policies before allowing an operation.
     * Throws PolicyViolationError if any REQUIRED policy blocks it.
     */
    executeWithGates<T>(operation: string, args: Record<string, unknown>, executor: () => Promise<T>, stage?: 'pre-exec' | 'post-exec' | 'review' | 'always'): Promise<T>;
    /**
     * Check policies without executing. Returns the gate result.
     */
    checkPolicies(operation: string, args: Record<string, unknown>, stage?: 'pre-exec' | 'post-exec' | 'review' | 'always'): Promise<GateResult>;
    /**
     * Evaluate a single policy against an operation.
     * Parses the policy's rawMarkdown for rules and checks them.
     * Serializes args ONCE and passes the cached string to each rule check
     * to avoid redundant JSON.stringify calls per-rule.
     */
    private evaluatePolicy;
    /**
     * Check a single rule against an operation.
     * Returns a violation message if the rule is violated, null otherwise.
     * Accepts pre-computed lowercase strings to avoid redundant serialization.
     */
    private checkRule;
    /**
     * Extract structured rules from policy content.
     * Supports two formats:
     * 1. Structured YAML/JSON rules block (preferred, extensible):
     *    ```rules
     *    - title: "Rule name"
     *      keywords: [keyword1, keyword2]
     *      antiPatterns: [pattern1, pattern2]
     *    ```
     * 2. Legacy markdown numbered rules with bold titles (auto-extracted)
     */
    private extractRules;
    /**
     * Parse structured YAML-like rules from a ```rules block.
     * Format: lines starting with "- title:" followed by "  keywords:" and "  antiPatterns:"
     */
    private parseStructuredRules;
    /**
     * Get the audit trail for a policy or all policies.
     */
    getAuditTrail(policyId?: string, limit?: number): Promise<import("./database-manager.js").PolicyExecutionRow[]>;
}
export declare function getPolicyGate(): PolicyGate;
//# sourceMappingURL=policy-gate.d.ts.map