/**
 * Row-Level Security (RLS) utilities for query merging
 *
 * Provides helper functions to merge RLS filter conditions into database queries.
 * This is the CORE of centralized RLS enforcement - all read operations
 * automatically apply these filters when present in meta.rlsFilter.
 */
import { FilterQuery, PipelineStage } from 'mongoose';
import { META } from '../../definitions';
/**
 * Merge user query with RLS filter from ctx.meta
 * This is called by all read operations to enforce row-level security.
 *
 * @param filter - Original user query filter
 * @param meta - Request metadata containing rlsFilter
 * @returns Merged filter with RLS conditions applied
 *
 * @example
 * // User query: { status: 'active' }
 * // RLS filter: { departmentId: 'dept-001' }
 * // Result: { $and: [{ status: 'active' }, { departmentId: 'dept-001' }] }
 */
export declare function mergeWithRLSFilter<T>(filter: FilterQuery<T> | Record<string, unknown> | undefined, meta?: META): FilterQuery<T>;
/**
 * Inject RLS filter as $match stage at beginning of aggregation pipeline
 *
 * @param pipeline - Original aggregation pipeline
 * @param meta - Request metadata containing rlsFilter
 * @returns Pipeline with RLS $match stage prepended (if rlsFilter exists)
 *
 * @example
 * // Pipeline: [{ $group: { _id: '$status' } }]
 * // RLS filter: { departmentId: 'dept-001' }
 * // Result: [{ $match: { departmentId: 'dept-001' } }, { $group: { _id: '$status' } }]
 */
export declare function injectRLSMatchStage(pipeline: PipelineStage[] | undefined, meta?: META): PipelineStage[];