/**
 * Separate AST pass for `policy.protectedColumns`.
 *
 * Do not fold this into the lineage/mask walk in governance.ts — that walk
 * decides what to redact in the result set. This walk decides whether the
 * statement is allowed to ask the database about a protected value at all.
 */
import type { SelectStatement, Statement } from 'pgsql-ast-parser';
import type { GovernancePolicy } from './types.js';
export type ProtectedPosition = 'WHERE' | 'HAVING' | 'JOIN' | 'ORDER BY' | 'GROUP BY' | 'SELECT';
export declare function protectedColumnDenyMessage(column: string, position: ProtectedPosition): string;
export declare function matchColumnGlob(pattern: string, value: string): boolean;
/**
 * Boot-time: a non-empty `protectedColumns` is a promise. If this process
 * cannot walk the AST for predicate positions, refuse to start.
 */
export declare function assertProtectedColumnsSupported(policy?: GovernancePolicy): void;
export declare function enforceProtectedColumns(statement: Statement | SelectStatement, patterns: string[], deny: (reason: string) => never): void;
//# sourceMappingURL=protected-columns.d.ts.map