import { type EnforceMode, type AuthzExtensionOptions } from './prisma-extension';
import type { ResourceManifest } from '../define-resource';
export interface ApplyAuthzExtensionOptions {
    /** I manifest del servizio (RESOURCES). */
    resources: readonly ResourceManifest[];
    /** DMMF con `isList` reale (src/prisma/datamodel `datamodel.models` o src/authz/datamodel `authzDatamodel`). MAI `Prisma.dmmf` runtime (isList=undefined in Prisma 7). */
    dmmf: AuthzExtensionOptions['dmmf'];
    /** Default: env `AUTHZ_ENFORCE_MODE` o 'off'. */
    mode?: EnforceMode;
    /** Override del client per la ricorsione nested-write. Default: il client esteso stesso (lazy). */
    getClient?: () => unknown;
    /** Estensioni Prisma da applicare PRIMA dell'authz (es. soft-delete), in ordine. */
    preExtensions?: unknown[];
    /** Callback shadow (metrics) inoltrata all'extension. */
    onShadow?: AuthzExtensionOptions['onShadow'];
}
/**
 * Applica l'authz Prisma-extension su un client base, gestendo il pattern subdolo
 * `getClient: () => extended` (closure lazy sul client finale, per la ricorsione dei
 * nested-write). Copre entrambe le topologie della flotta:
 *
 *   // prisma.service.ts (constructor)
 *   const extended = applyAuthzExtension(this, { resources: RESOURCES, dmmf: datamodel.models });
 *
 *   // prisma.module.ts (factory, con soft-delete prima)
 *   const extended = applyAuthzExtension(prisma, {
 *     resources: RESOURCES, dmmf: authzDatamodel, preExtensions: [softDeleteExtension],
 *   });
 *
 * Mode-gated: `off` = passthrough (zero behaviour change). Sostituisce il blocco
 * `let extended; extended = base.$extends(createAuthzPrismaExtension(getResourceRegistry(...), {...getClient: () => extended}))`.
 */
export declare function applyAuthzExtension<TBase extends {
    $extends: (ext: any) => any;
}>(base: TBase, opts: ApplyAuthzExtensionOptions): any;
//# sourceMappingURL=apply-authz-extension.d.ts.map