/**
 * scanDbToolScoping — ported from `scripts/guard-db-tool-scoping.mjs`.
 *
 * The agent's raw DB tools (`db-query`, `db-exec`, `db-patch`) can only
 * safely expose tables with an explicit tenant scope (`owner_email` and/or
 * `org_id`) or a documented, reviewed exception. This guard keeps schema
 * drift visible: any table without raw-DB scope must either add
 * `owner_email`/`org_id`, or be added to the denylist with a
 * reviewer-readable reason.
 *
 * Conditional guard — per report 005's V1 guard set table: the original
 * walks every `templates/*\/server/db/schema.ts` and keys its denylist
 * `"<template>:<table>"`. A generated app has exactly one
 * `server/db/schema.ts` (confirmed convention), so this port scans that
 * single file and uses bare `"<table>"` denylist keys. The denylist itself
 * comes from `agent-native.json`'s `doctor.dbToolScopingDenylist` (see
 * `../cli/doctor.ts`) — empty by default; app authors add entries with the
 * same reviewer-readable-reason convention as the original constant.
 *
 * Not ported: the original also resolves `export * from
 * "@agent-native/<pkg>/schema"` re-exports back to that package's
 * `packages/<pkg>/src/schema/*.ts` monorepo source, so template schemas
 * that re-export scheduling/dispatch tables get scanned too. In a
 * generated app those packages are compiled `node_modules` output (no
 * `.ts` source to brace-parse), and report 005's parameterization note
 * doesn't cover that case, so re-export resolution is intentionally
 * dropped for app mode: a re-exported table from an `@agent-native/*`
 * package is not scanned here (false-negative, not false-positive) — see
 * the plan's STOP-condition guidance ("report rather than invent new
 * detection logic").
 */
import type { GuardResult, GuardScanOptions } from "./types.js";
export interface DbToolScopingOptions extends GuardScanOptions {
    /** Table name -> reviewer-readable reason. Default `{}`. */
    denylist?: Record<string, string>;
}
export declare function scanDbToolScoping(options: DbToolScopingOptions): GuardResult;
//# sourceMappingURL=db-tool-scoping.d.ts.map