import type { ResourceRegistry } from '../resource-registry';
export type EnforceMode = 'off' | 'shadow' | 'enforce';
/** Minimal DMMF shape (pass `Prisma.dmmf.datamodel.models`) used to scope nested reads. */
export interface DmmfModelLike {
    name: string;
    fields: Array<{
        name: string;
        kind: string;
        type: string;
        isList?: boolean;
    }>;
}
export interface AuthzExtensionOptions {
    mode?: EnforceMode;
    /** called in shadow mode with what WOULD be restricted (metrics/logging). */
    onShadow?: (info: {
        model: string;
        operation: string;
        subject: string;
    }) => void;
    /**
     * Prisma DMMF models (`Prisma.dmmf.datamodel.models`). When provided, the extension
     * recursively scopes to-many `include`/`select` relations on managed models. Without it,
     * nested to-many reads on a managed model FAIL CLOSED in enforce (a tamper-proof default).
     */
    dmmf?: DmmfModelLike[];
    /** Prisma model names (PascalCase) intentionally left unmanaged (read fully). Use sparingly. */
    allowUnmanaged?: string[];
    /**
     * Returns the scoped (extended) Prisma client, used to PRE-VERIFY that nested
     * `connect`/`set`/`connectOrCreate` targets to existing rows are within the caller's
     * read scope (Prisma can't `where`-filter a connect). When provided, enforce mode runs
     * a scoped read of each link target and throws `LINK_DENIED` if any is out of scope.
     * Pass a thunk because the client doesn't exist until after `$extends`.
     */
    getClient?: () => any;
}
export declare function createAuthzPrismaExtension(registry: ResourceRegistry, opts?: AuthzExtensionOptions): {
    name: string;
    query: {
        $allModels: {
            $allOperations({ model, operation, args, query }: {
                model: string;
                operation: string;
                args: any;
                query: (a: any) => Promise<unknown>;
            }): Promise<any>;
        };
        $queryRaw({ args, query }: any): Promise<unknown>;
        $queryRawUnsafe({ args, query }: any): Promise<unknown>;
        $executeRaw({ args, query }: any): Promise<unknown>;
        $executeRawUnsafe({ args, query }: any): Promise<unknown>;
    };
};
//# sourceMappingURL=prisma-extension.d.ts.map