/**
 * The gate `license.ts` consults before letting a paid feature run.
 *
 * This file described itself as "comprehensive protection against business logic
 * vulnerabilities including authorization bypasses, privilege escalation, and data leakage",
 * and was 520 lines of exactly that shape: an authorization rule registry, tenant-isolation
 * checks, a recursive `sanitizeData` for sensitive fields, and an audit log.
 *
 * None of it was reachable. `validateFeatureAccess` is the only thing any caller uses; the
 * registry, the sanitiser and the audit log had no readers at all, so nothing was being
 * protected by them. What is left is the licence gate itself, which is real and tested in
 * tests/business-security-gate.test.ts.
 */
import { LicenseInfo } from '../license';
export interface SecurityContext {
    userId: string;
    roles: string[];
    tenantId?: string;
    permissions: string[];
    sessionId: string;
    isAdmin: boolean;
    licenseInfo?: LicenseInfo;
}
export declare class BusinessSecurityError extends Error {
    readonly errorType: 'authorization' | 'tenant_isolation' | 'privilege_escalation' | 'data_leakage';
    readonly context?: Record<string, unknown> | undefined;
    constructor(message: string, errorType: 'authorization' | 'tenant_isolation' | 'privilege_escalation' | 'data_leakage', context?: Record<string, unknown> | undefined);
}
/**
 * Business Logic Security Manager
 */
export declare class BusinessSecurity {
    /**
     * Validate feature access with comprehensive checks
     */
    validateFeatureAccess(feature: string, license: LicenseInfo | null, context: SecurityContext): {
        allowed: boolean;
        reason?: string;
    };
    private getFeaturePlans;
    private getMinimumPlan;
    private describePlan;
    private validateSecurityContext;
}
/**
 * Global business security instance
 */
export declare const businessSecurity: BusinessSecurity;