import type { BasaltRoute } from './route.js';
/**
 * The security-relevant route-meta keys the framework knows about. Each is
 * enforced by a guard that a specific plugin registers:
 *
 * - `auth`, `mfa` — `@basaltkit/auth`'s `authPlugin`
 * - `can` — `@basaltkit/permissions`' `permissionsPlugin`
 * - `teamRole` — `@basaltkit/teams`' `teamsPlugin`
 * - `scopes` — `@basaltkit/auth`'s `apiKeysPlugin`
 * - `subscribed`, `feature` — `@basaltkit/subscriptions`' `subscriptionsPlugin`
 *
 * Declaring one of these on a route is a *request* for protection; the guard is
 * what enforces it. A route that declares a key nobody enforces would silently
 * serve unprotected — the adapters therefore call {@link assertRoutesGuarded}
 * at boot and fail loud instead.
 *
 * Deliberately NOT in this set: `central` (a tenant-membership *opt-out* — a
 * missing plugin removes a bypass, never a check), `mcp` (an exposure opt-in)
 * and `rateLimit` (abuse throttling, not an authorization boundary, and legal
 * to declare with `securityPlugin`'s optional rate limiter switched off).
 */
export declare const GUARDED_META_KEYS: readonly ['auth', 'mfa', 'can', 'teamRole', 'scopes', 'subscribed', 'feature'];
/**
 * Metadata bucket where enforcing plugins claim the meta key(s) their guards
 * consume (e.g. authPlugin adds `'auth'`). String-keyed — no package coupling.
 */
export declare const GUARDED_META_BUCKET = "http:guarded-meta";
/** Boot-time error: routes declare security meta that no registered guard enforces. */
export declare class UnguardedRouteMetaError extends Error {
    readonly code = "HTTP_UNGUARDED_ROUTE_META";
    constructor(offenders: {
        route: string;
        key: string;
    }[]);
}
/**
 * Fails loud (at boot) when a route declares one of {@link GUARDED_META_KEYS}
 * and no registered guard claimed that key via {@link GUARDED_META_BUCKET}.
 * `allow` waives the check: `true` for everything (edge-auth deployments),
 * or an array of specific keys. A value of `false`/`undefined` on the route's
 * meta is an explicit opt-off, not a protection request — never flagged.
 */
export declare function assertRoutesGuarded(routes: readonly BasaltRoute[], claimed: ReadonlySet<string>, allow?: boolean | readonly string[]): void;