/**
 * PZG Pro - Postgres RLS Generator
 * DMMF-based implementation for RLS policy generation
 */
import { ProFeatureBase } from '../../core/ProFeatureBase';
export interface PostgresRLSConfig {
    outputPath?: string;
    enableAuditLogging?: boolean;
    enableRowOwnership?: boolean;
    ownershipField?: string;
    tenantField?: string;
    generateMigrations?: boolean;
    migrationFormat?: 'sql' | 'prisma';
}
export interface RLSPolicy {
    name: string;
    table: string;
    operation: 'SELECT' | 'INSERT' | 'UPDATE' | 'DELETE' | 'ALL';
    role?: string;
    expression?: string;
    check?: string;
    description?: string;
}
export interface PolicyRule {
    type: 'read' | 'write' | 'create' | 'update' | 'delete';
    subtype?: 'where';
    condition: string;
    field?: string;
    contextVariable?: string;
}
export interface ModelPolicies {
    modelName: string;
    /** The table Prisma actually creates: the model name, or `@@map`'s argument when present. */
    tableName: string;
    /** Column names, so a tenant predicate is only added to a table that has the column. */
    fieldNames: string[];
    policies: PolicyRule[];
}
export declare class PostgresRLSGenerator extends ProFeatureBase {
    private config;
    constructor(context: any, config?: PostgresRLSConfig);
    protected getFeatureName(): string;
    protected generateFeature(): Promise<void>;
    private extractModelPolicies;
    /**
     * Parse the `/// @policy` syntax the rest of the product uses.
     *
     * This previously parsed `@policy.read(where: "userId = ctx.userId")` — a form that appears in no
     * documentation, and one the extractor cannot even deliver: `extractAnnotationsFromComment`
     * matches `@policy` followed by whitespace, so `@policy.read(...)` never reaches here. Between
     * that and model-level annotations being read with an empty field name, the pack had never emitted
     * a single policy; it wrote its helper functions and reported success.
     *
     * The accepted forms are the ones the policies pack implements and the docs describe:
     *
     *   /// @policy read:where tenantId == ctx.tenantId
     *   /// @policy read:role in ["admin"]
     *   /// @policy delete:where userId == ctx.userId
     */
    private parsePolicyAnnotation;
    private generateRLSPolicies;
    private convertPolicyToRLS;
    /** Double-quote an identifier so PostgreSQL does not case-fold it, escaping any embedded quote. */
    private quoteIdent;
    private convertConditionToSQL;
    private generateRLSSQL;
    private generateHelperFunctions;
    private generatePrismaMigration;
    private generateRLSHelper;
    private generateRLSDocumentation;
}