import { Neo4jService } from "../../../core/neo4j/services/neo4j.service";
import { CatalogEntity } from "../interfaces/graph.catalog.interface";
import { GraphCatalogService } from "./graph.catalog.service";
import { UserContext } from "../tools/tool.factory";
/**
 * Single place a scope predicate is built or applied. Every agent data-access
 * point routes through here so "which campaign is this run confined to" has
 * exactly one answer.
 *
 * Fail-closed rule: in a scoped run, a type with no compiled scope chain is
 * treated as OUT of scope. The alternative — treating it as universally
 * visible — is a cross-scope leak, which is the whole failure this service
 * exists to prevent.
 */
export declare class ScopeGuard {
    private readonly catalog;
    private readonly neo4j;
    private readonly logger;
    constructor(catalog: GraphCatalogService, neo4j: Neo4jService);
    buildMatchClause(params: {
        entity: CatalogEntity;
        ctx: UserContext;
        nodeAlias: string;
    }): {
        cypher: string;
        params: Record<string, unknown>;
    } | null;
    isInScope(params: {
        type: string;
        id: string;
        ctx: UserContext;
    }): Promise<boolean>;
    filter<T extends {
        id: string;
    }>(params: {
        type: string;
        records: T[];
        ctx: UserContext;
    }): Promise<T[]>;
    /** `(alias)-[:REL]->(:Label)…-[:REL]->(:Root { id: $scopeId })` */
    private buildPattern;
}
//# sourceMappingURL=scope.guard.d.ts.map