/**
 * scanUnscopedQueries — ported from `scripts/guard-no-unscoped-queries.mjs`.
 *
 * Refuse to let any code query an "ownable" resource table (one that
 * spreads `...ownableColumns()`) without going through framework access
 * control: `accessFilter` / `resolveAccess` / `assertAccess`, or an
 * explicit `ownerEmail` / `userEmail` / `orgId` filter. The check is
 * per-STATEMENT, scoped to the enclosing block, so a sibling `if` branch
 * that correctly scopes its query does not defuse an unscoped sibling.
 *
 * Conditional guard — per report 005's V1 guard set table: the original
 * restricts scanning to `templates/[^/]+/(server|actions)/` and
 * `packages/[^/]+/src/`, and hardcodes a `FILE_ALLOWLIST` of this
 * framework's own sharing-primitive implementation files. For a generated
 * app (no `templates/`/`packages/` wrapper — source lives at `actions/`
 * and `server/` under the app root), this port scans `actions/` and
 * `server/` directly and drops the hardcoded allowlist in favor of an
 * optional `extraExemptPaths` param (default `[]`).
 *
 * Opt-out (within the enclosing block, or as a file header for whole-file
 * opt-outs):
 *   // guard:allow-unscoped — short reason
 */
import type { GuardResult, GuardScanOptions } from "./types.js";
export interface UnscopedQueriesOptions extends GuardScanOptions {
    /** Exact repo-relative paths to exempt from the per-statement scan
     * (e.g. this app's own sharing-primitive implementation, if any).
     * Default `[]`. */
    extraExemptPaths?: string[];
}
export declare function scanUnscopedQueries(options: UnscopedQueriesOptions): GuardResult;
//# sourceMappingURL=no-unscoped-queries.d.ts.map