import type { CodexSsoIdentity, CodexRoleGate, CodexRole } from '../../types/codex.js';
/**
 * Parse SAML/OIDC identity from Codex enterprise environment variables.
 * Returns null if no identity context is available (non-enterprise or unauthenticated).
 */
export declare function parseCodexIdentity(): CodexSsoIdentity | null;
/**
 * Evaluate role-based access gate for a tool invocation.
 * Logs the decision to audit_log_export regardless of outcome.
 * Returns false if identity is missing or role is insufficient.
 */
export declare function evaluateRoleGate(projectPath: string, toolName: string, requiredRole: CodexRole, identity: CodexSsoIdentity | null): CodexRoleGate;
/**
 * Check if a given identity satisfies a required role.
 * Convenience wrapper around evaluateRoleGate for boolean checks.
 */
export declare function hasRequiredRole(identity: CodexSsoIdentity, requiredRole: CodexRole): boolean;
//# sourceMappingURL=enterprise-auth.d.ts.map