import type { ResourceManifest } from '../define-resource';
export type ViolationLevel = 'error' | 'warn';
export interface Violation {
    level: ViolationLevel;
    code: string;
    subject?: string;
    message: string;
}
export interface DmmfField {
    name: string;
    kind?: string;
    relationName?: string;
    type?: string;
}
export interface DmmfModel {
    name: string;
    fields: DmmfField[];
}
export interface DmmfLike {
    models: DmmfModel[];
}
export interface CheckOptions {
    dmmf?: DmmfLike;
    /** Models intentionally excluded from authz (DEC-3 opt-out, e.g. OidcEntity). */
    optOut?: string[];
    /**
     * Consumer's allowlist of valid `$ctx` paths (its context vocabulary). When provided,
     * any scope path outside it is flagged. When omitted, only structural validity is
     * checked — the SDK is agnostic and does not know an app's context shape.
     */
    knownCtxPaths?: readonly string[];
}
/** Collect every `$ctx` path referenced anywhere inside the scope templates. */
export declare function collectCtxPaths(template: unknown, acc?: string[]): string[];
/** DEC-14/15: actions must be built-in, lifecycle-derived, or non-empty custom. */
export declare function checkActions(m: ResourceManifest): Violation[];
/** DEC-23/EDGE-24: softDelete:false ⇒ no delete/softDelete/restore/findDeleted. */
export declare function checkSoftDelete(m: ResourceManifest): Violation[];
/** Every `$ctx` path must be structurally valid, and — if the consumer supplied an
 *  allowlist — present in it. The SDK itself stays agnostic to the context vocabulary. */
export declare function checkCtxPaths(m: ResourceManifest, knownCtxPaths?: readonly string[]): Violation[];
/** DEC-28: lifecycle states/transitions internally consistent. */
export declare function checkLifecycle(m: ResourceManifest): Violation[];
/**
 * A lifecycle transition's `requires: [SCOPE]` must have a matching scope declared
 * in `scopes`. Otherwise the transition is either unauthorizable or silently falls
 * back to another scope (e.g. an owner self-approving). Catches the class the
 * adversarial review flagged on IndividualCompetence (requires TENANT, only OWN).
 */
export declare function checkLifecycleRequiresScopes(m: ResourceManifest): Violation[];
/** DEC-6..10: tenancy declaration shape is well-formed for its kind. */
export declare function checkTenancyShape(m: ResourceManifest): Violation[];
/**
 * Every resource must declare at least one scope (else nothing is enforceable).
 * A `global`-tenancy resource that exposes only OWN/TENANT (no GLOBAL) is a
 * legitimate pattern — a table with no tenant column whose visibility is
 * owner-based (e.g. EmployeeSurvey, JuridicalSurvey) — so it is NOT warned.
 */
export declare function checkScopesPresence(m: ResourceManifest): Violation[];
/** DEC-S8.5: external link should be a multiRef whose fields cover provider/customer. */
export declare function checkExternalConsistency(m: ResourceManifest): Violation[];
/**
 * DEC-3: Subject is unique GLOBALLY (the codegen Subject union spans all services).
 * prismaModel is unique only WITHIN a service — two services legitimately own a
 * `client`/`user`/`individual` model in separate databases, so the model key is
 * scoped by service. Within one service the per-service check still catches dups.
 */
export declare function checkUniqueness(manifests: ResourceManifest[]): Violation[];
/** DEC-25a / EDGE-S8.5: polymorphicMap targets must resolve to known subjects. */
export declare function checkPolymorphicTargets(manifests: ResourceManifest[]): Violation[];
/** DEC-19: model exists; tenancy/ownership fields exist; scope top-level fields exist. */
export declare function checkAgainstDmmf(m: ResourceManifest, dmmf: DmmfLike): Violation[];
/** DEC-3 / coverage gate: every datamodel model is covered or explicitly opted out. */
export declare function checkCoverage(manifests: ResourceManifest[], dmmf: DmmfLike, optOut?: string[]): Violation[];
/** Run every check (manifest-only always; DMMF-backed + coverage if `dmmf` given). */
export declare function runChecks(manifests: ResourceManifest[], opts?: CheckOptions): Violation[];
export declare function hasErrors(violations: Violation[]): boolean;
//# sourceMappingURL=check-rules.d.ts.map