import type { PrismaAbility } from '@casl/prisma';
/**
 * `$ctx` path used inside scope templates. Free-form: it is resolved at snapshot-build
 * time against the request context (dotted path, e.g. 'tenantId' or 'connected.peers').
 * The set of valid paths is defined by the CONSUMER's context shape, not by the SDK.
 */
export type CtxPath = string;
/**
 * Authorization context for a request. Lives in AsyncLocalStorage.
 * Read by: ScopedRepository, the Prisma extension hook, GenQuery, GlobalAuthzGuard.
 *
 * The named fields are the only ones the engine reads; the open index signature lets
 * a consumer attach any domain claims (e.g. `juridicalIndividualId`, `connected`) that
 * its manifests reference via `$ctx`. Apps typically `extend` this with a typed shape.
 */
export interface AuthzContext {
    /** Authenticated principal id. */
    userId: string;
    /** Generic multi-tenancy key (single-tenancy stamping + the TENANT scope). */
    tenantId?: string;
    /** Hydrated PrismaAbility (`createPrismaAbility(snapshot.rules)`). */
    ability: PrismaAbility<any>;
    /** Snapshot identifier (Step 4) — propagated in the internal JWT `snap` claim. */
    snapId?: string;
    /** Truncated permission hash (Step 4) — JWT claim `ph` for a sanity/staleness check. */
    permHash?: string;
    /** Set by `runUnscoped()` (Step 3) — the extension bypasses scoping when true. */
    unscoped?: boolean;
    unscopedReason?: string;
    /**
     * Metadati forensi per l'audit trail (additivi, NON di sicurezza).
     * Popolati al gateway e inoltrati nel JWT interno (claim ip/ua/rid).
     * Funzionano già via l'index signature aperta; qui solo per tipizzazione.
     */
    ip?: string;
    userAgent?: string;
    requestId?: string;
    /** onBehalfOf: azienda cliente target per cui agisce un Consulente del Lavoro. */
    onBehalfOf?: string;
    /** Override action for a lifecycle transition (Step 3). */
    actionOverride?: string;
    /** Per-request cache for `accessibleBy(ability, action)[subject]` (Step 3). */
    accessibleByCache?: Map<string, unknown>;
    /** Soft-delete mode (Step 3): default null, opt-in 'include-deleted' / 'only-deleted'. */
    softDeleteMode?: 'normal' | 'include-deleted' | 'only-deleted';
    /** Domain claims for `$ctx` substitution — consumer-defined, opaque to the SDK. */
    [claim: string]: unknown;
}
/** Empty baseline used by `runUnscoped()` when there is no parent context. */
export declare const EMPTY_CTX: AuthzContext;
//# sourceMappingURL=authz-context.d.ts.map