/**
 * Web UI API Routes
 *
 * REST endpoints for reading portfolio elements.
 * Read-only — no mutations in V1.
 *
 * All element content is sanitized before serving to prevent XSS.
 *
 * Security note: This web server binds to 127.0.0.1 only (see server.ts).
 * Rate limiting on read-only GET endpoints is not required for localhost-only
 * management interfaces. The POST /api/install endpoint has explicit rate limiting
 * via SlidingWindowRateLimiter (max 10 per minute).
 * codeql[js/missing-rate-limiting] — Acknowledged; localhost-only binding mitigates DoS risk.
 */
import { Router } from 'express';
import type { MCPAQLHandler } from '../handlers/mcp-aql/MCPAQLHandler.js';
export declare function createApiRoutes(portfolioDir: string): Router;
/**
 * Create API routes that route through MCPAQLHandler (gateway mode).
 * All operations go through the MCP-AQL pipeline: validation, cache, gatekeeper.
 *
 * Falls back to direct filesystem for /api/collection (external fetch, no MCP-AQL equivalent)
 * and /api/stats (lightweight aggregate, no matching operation).
 */
export declare function createGatewayApiRoutes(handler: MCPAQLHandler, portfolioDir: string): Router;
//# sourceMappingURL=routes.d.ts.map