import type { NodeDefinition, SchemaMetadata } from '../schema/types';
import { type Operation, type PolicyContextBundle } from './types';
/**
 * Evaluate `'create'` policies in JS for `inputs` of `typeName`.
 *
 * - Override → all input is allowed.
 * - Permissive → at least one (whose `appliesWhen` matches) must exist;
 *   create cannot fall back to default-deny silent-empty.
 * - Restrictive → `when(ctx, input)` must return exactly `true` for every
 *   input (v1.8.7 — explicit positive consent).
 *
 * A permissive's `when(ctx)` where-partial is a SHAPE hint only — it is
 * not compiled against the input. Restrictive `when(ctx, input)` is the
 * canonical "WITH CHECK" hook.
 */
export declare function evaluateCreatePolicies(bundle: PolicyContextBundle | null, typeName: string, inputs: ReadonlyArray<Record<string, unknown>>): void;
/**
 * Evaluate WRITE-side restrictives (create/update) at the application
 * layer. Each `WriteRestrictive` is invoked once with `(ctx, input)`;
 * anything but an explicit `true` rejects with `PolicyDeniedError`.
 * ReadRestrictives are not consumed here — they filter rows via the
 * compiled WHERE clause.
 */
export declare function evaluateWriteRestrictives(bundle: PolicyContextBundle | null, typeName: string, operation: Operation, input: Record<string, unknown> | undefined): void;
/**
 * Check every nested `create` / `update` inside create inputs of
 * `nodeDef` (the root's own checks are the caller's).
 */
export declare function assertNestedCreatesAllowed(schema: SchemaMetadata, nodeDef: NodeDefinition, inputs: ReadonlyArray<Record<string, unknown>>, bundle: PolicyContextBundle | null): void;
/**
 * Check every nested `create` / `update` inside an update input of
 * `nodeDef` (the root's own checks are the caller's).
 */
export declare function assertNestedUpdatesAllowed(schema: SchemaMetadata, nodeDef: NodeDefinition, update: Record<string, unknown> | undefined, bundle: PolicyContextBundle | null): void;
//# sourceMappingURL=nested-writes.d.ts.map