/**
 * Shared RLS (Row-Level Security) scoping helper.
 *
 * DataDrivers may implement a `withAuth()` method that returns a scoped
 * clone of the driver with RLS policies applied for the given user.
 * This is database-specific (e.g. Postgres SET LOCAL ROLE) and is not
 * part of the core DataDriver interface.
 *
 * This module provides the shared duck-typing logic used by the
 * adapter-aware middleware.
 *
 * @module
 */
import type { DataDriver } from "@rebasepro/types";
/**
 * Scope a DataDriver via `withAuth()` for RLS.
 *
 * SECURITY: If `withAuth()` is available but fails, the error is re-thrown
 * so the request is **denied** rather than proceeding with unscoped access
 * (fail-closed behavior).
 *
 * If the driver does not support RLS, the original driver is returned.
 *
 * @param driver - The DataDriver to scope.
 * @param user   - The authenticated user identity for RLS.
 * @returns The RLS-scoped DataDriver (or the original if RLS is unsupported).
 */
export declare function scopeDataDriver(driver: DataDriver, user: {
    uid: string;
    roles?: string[];
}): Promise<DataDriver>;