/**
 * Mount resolution
 *
 * Turns mount options plus the manifests into the concrete list of routes a framework
 * should register, and refuses — loudly, at startup — any configuration that would be
 * wrong at request time.
 *
 * All three adapters resolve through here, so route selection, delivery validation and
 * the admin authorization requirement behave identically on NestJS, Express and Fastify.
 *
 * @packageDocumentation
 */
import { NAuthConfig } from '../interfaces/config.interface';
import { AnyNAuthRouteDefinition } from './route-manifest.types';
import { NAuthRouteServices } from './route-services';
import { NAuthRouteGroup, NAuthRouteKey } from './route-keys';
/** Every shipped route, self-service first. */
export declare const ALL_ROUTES_MANIFEST: readonly AnyNAuthRouteDefinition[];
/** A guard class, guard instance, or DI token (NestJS); a middleware (Express/Fastify). */
export type GuardLike = unknown;
/** How one bundle of shipped routes is mounted. */
export interface NAuthRouteMountOptions {
    /**
     * Whether to mount at all.
     * @default true
     */
    enabled?: boolean;
    /**
     * Path prefix for this bundle, relative to any framework-wide prefix.
     * @default 'auth'
     */
    prefix?: string;
    /**
     * Which groups to mount.
     * @default every group except `admin` and `apiKeysAdmin`
     */
    groups?: readonly NAuthRouteGroup[];
    /**
     * Individual routes to leave out — to hand-write them, or to not expose them at all.
     *
     * Removes the endpoint, **not the capability**: the underlying service method stays
     * callable in-process. To forbid an operation outright, deny its action in the
     * authorization provider as well.
     *
     * An unknown key is rejected at mount time, so a typo cannot silently re-expose a
     * route that was meant to be suppressed.
     */
    exclude?: readonly NAuthRouteKey[];
    /**
     * Force every route in this bundle to one delivery mode.
     *
     * Requires `tokenDelivery.method: 'hybrid'` unless it matches the configured method.
     */
    delivery?: 'json' | 'cookies';
    /** Guards applied to every route in this bundle. */
    guards?: readonly GuardLike[];
    /** Guards applied only to routes with `access: 'admin'`. */
    adminGuards?: readonly GuardLike[];
    /** Guards applied to individual routes, merged with the above. */
    routeGuards?: Partial<Record<NAuthRouteKey, readonly GuardLike[]>>;
}
/** A mount resolved against the configuration and the available services. */
export interface ResolvedRouteMount {
    /** Prefix with any leading and trailing slashes removed. */
    readonly prefix: string;
    /** The routes to register, in manifest order. */
    readonly routes: readonly AnyNAuthRouteDefinition[];
    /** Delivery mode forced on this bundle, if any. */
    readonly delivery?: 'json' | 'cookies';
    /** The original options, for adapters that need the guard lists. */
    readonly options: NAuthRouteMountOptions;
}
/**
 * Normalize one or many mount options into an array.
 *
 * @param routes - What the consumer configured
 * @returns Zero or more mount option objects
 */
export declare function normalizeMounts(routes?: NAuthRouteMountOptions | readonly NAuthRouteMountOptions[]): readonly NAuthRouteMountOptions[];
/**
 * Reject mounts whose delivery modes the configuration cannot serve.
 *
 * A per-route delivery override is only meaningful when both transports are live, which
 * is what `method: 'hybrid'` means. Checking here turns what would otherwise be a
 * first-request failure into a startup failure naming the offending bundle.
 *
 * @param config - The active configuration
 * @param mounts - Every bundle about to be mounted
 * @throws {Error} When a requested delivery mode conflicts with `tokenDelivery.method`
 */
export declare function assertMountsCompatible(config: NAuthConfig, mounts: readonly NAuthRouteMountOptions[]): void;
/** What `resolveMount` needs to know about the environment it is mounting into. */
export interface ResolveMountEnvironment {
    /** The active configuration. */
    config: NAuthConfig;
    /** Which optional services exist, so routes requiring an absent one are dropped. */
    services?: Partial<NAuthRouteServices>;
    /**
     * Whether an authorization provider is configured.
     *
     * Mounting an admin group without one is refused: with no role model in the toolkit,
     * those routes would otherwise be reachable by any authenticated caller.
     */
    authorizationConfigured?: boolean;
}
/**
 * Resolve one mount into the routes a framework should register.
 *
 * @param options - The bundle's options
 * @param env - Configuration, available services, and whether authorization is configured
 * @returns The resolved mount, or `undefined` when the bundle is disabled
 * @throws {Error} On an unknown `exclude` key, or an admin group with no authorization provider
 */
export declare function resolveMount(options: NAuthRouteMountOptions, env: ResolveMountEnvironment): ResolvedRouteMount | undefined;
//# sourceMappingURL=resolve-mount.d.ts.map