/**
 * This Source Code is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * Copyright (c) Infonomic Company Limited
 */
import type { RequestContext } from '@byline/auth';
import { type CollectionDefinition } from '../@types/collection-types.js';
import { type ParseContext } from '../query/parse-where.js';
import type { DocumentFilter, ReadContext } from '../@types/db-types.js';
import type { QueryPredicate } from '../@types/query-predicate.js';
/**
 * Resolve the per-collection `beforeRead` hook predicate for the current
 * request, with caching across populate fanout.
 *
 * Each configured hook function runs in declaration order. `false` is
 * normalized to the documented always-false predicate, and predicates from
 * multiple hooks are combined with implicit AND. Results are cached in
 * module-private state bound to one request authority; caller-owned
 * `ReadContext` properties are never consulted for authorization.
 *
 * Returns `null` when no hook is configured, or every hook returned
 * void. Callers (`CollectionHandle`, `populateDocuments`) treat `null`
 * the same as "no scoping" — they pass nothing extra to the adapter.
 */
export declare function applyBeforeRead(params: {
    definition: CollectionDefinition;
    requestContext: RequestContext;
    readContext: ReadContext;
    /** Stable adapter/client identity. Defaults to the definition for direct callers. */
    securityDomain?: object;
}): Promise<QueryPredicate | null>;
/**
 * Resolve and strictly compile the security predicate once per logical read.
 * Promise caching also prevents concurrent populate branches from compiling
 * the same predicate or resolving its relation collection ids more than once.
 */
export declare function compileBeforeReadFilters(params: {
    definition: CollectionDefinition;
    requestContext: RequestContext;
    readContext: ReadContext;
    parseContext: ParseContext;
    /** Stable identity shared by every fanout path using this adapter/client. */
    securityDomain: object;
}): Promise<DocumentFilter[] | undefined>;
/** Bind a logical read to one immutable request authority. */
export declare function bindReadContextAuthority(readContext: ReadContext, requestContext: RequestContext): void;