//#region src/utils/signozHelpers.d.ts
/**
 * Enforces server-side filters on SigNoz v5 builder queries.
 * Scopes to known Inkeep services and prevents tenant/project filter bypass.
 * Rejects non-builder query types to prevent tenant isolation bypass via raw SQL.
 */
declare function enforceSecurityFilters(payload: any, tenantId: string, projectId?: string): void;
/**
 * Builds a tenant-scoped ClickHouse SQL payload for looking up a single span.
 * Tenant filtering is baked into the WHERE clause so this never goes through
 * the generic proxy's enforceSecurityFilters (which rejects non-builder queries).
 */
declare function buildSpanLookupPayload(tenantId: string, conversationId: string, spanId: string, start: number, end: number): Record<string, unknown>;
//#endregion
export { buildSpanLookupPayload, enforceSecurityFilters };