import type { MastraFGAPermissionInput } from '@mastra/core/auth/ee';
import type { RequestContext } from '@mastra/core/di';
export declare function validateBody(body: Record<string, unknown>): void;
/**
 * sanitizes the body by removing disallowed keys.
 * @param body body to sanitize
 * @param disallowedKeys keys to remove from the body
 */
export declare function sanitizeBody(body: Record<string, unknown>, disallowedKeys: string[]): void;
export declare function parsePerPage(value: string | undefined, defaultValue?: number, max?: number): number | false;
/**
 * Parses filter query parameters into a key-value object.
 */
export declare function parseFilters(filters: string | string[] | undefined): Record<string, string> | undefined;
/**
 * Gets the effective resourceId, preferring the reserved key from requestContext
 * over client-provided values for security.
 */
export declare function getEffectiveResourceId(requestContext: RequestContext | undefined, clientResourceId: string | undefined): string | undefined;
/**
 * Gets the effective threadId, preferring the reserved key from requestContext
 * over client-provided values for security.
 */
export declare function getEffectiveThreadId(requestContext: RequestContext | undefined, clientThreadId: string | undefined): string | undefined;
/**
 * Validates that a thread belongs to the specified resourceId.
 * Throws 403 if the thread exists but belongs to a different resource.
 * Threads with no resourceId are accessible to all (shared threads).
 */
export declare function validateThreadOwnership(thread: {
    resourceId?: string | null;
} | null | undefined, effectiveResourceId: string | undefined): Promise<void>;
/**
 * Validates both coarse resource ownership and fine-grained thread access.
 * FGA enforcement is a no-op when either auth user or FGA provider is absent.
 */
export declare function enforceThreadAccess({ mastra, requestContext, threadId, thread, effectiveResourceId, permission, }: {
    mastra: any;
    requestContext?: RequestContext;
    threadId: string;
    thread?: {
        resourceId?: string | null;
    } | null;
    effectiveResourceId?: string;
    permission?: MastraFGAPermissionInput;
}): Promise<void>;
/**
 * Validates that a workflow run belongs to the specified resourceId.
 * Throws 403 if the run exists but belongs to a different resource.
 */
export declare function validateRunOwnership(run: {
    resourceId?: string | null;
} | null | undefined, effectiveResourceId: string | undefined): Promise<void>;
//# sourceMappingURL=utils.d.ts.map