import { type Method } from "../router/router.js";
/** Where enforcement evidence follows Nifra's route-registration semantics. */
export type AssuranceScope = "global" | "subsequent" | "plugin";
/** Reflection-safe proof that a named enforcement module covered a route. */
export interface AssuranceEvidence {
    readonly id: string;
    readonly source: string;
    /** Runtime-installed enforcement versus an author assertion on a route. Optional for legacy
     * reflected descriptors; evaluators infer legacy values from source when absent. */
    readonly provenance?: "runtime" | "declared";
}
/** Metadata installed on a middleware/plugin by {@link withRouteAssurance}. */
export interface AssuranceDeclaration extends AssuranceEvidence {
    readonly scope: AssuranceScope;
    /** Restrict evidence to these HTTP methods. Omit for every method. */
    readonly methods?: readonly Method[];
    /** Restrict evidence to these absolute route globs. Omit for every path. */
    readonly paths?: readonly string[];
}
/**
 * Evidence published from OUTSIDE the plugin chain - a deployment shell, a mount site, the call that
 * hands the app to `serve`. `scope` defaults to `global` (retroactive, app-wide) because the shell
 * runs after every route is registered, and `provenance` is always stamped `declared`: nifra did not
 * install this enforcement and cannot see it, so a `requireProvenance: "runtime"` rule still rejects it.
 */
export type AssuranceAttachment = Omit<AssuranceDeclaration, "scope" | "provenance"> & {
    readonly scope?: AssuranceScope;
};
export declare const NIFRA_ASSURANCE_IDS: Readonly<{
    readonly AUTHENTICATED: "nifra.authenticated";
    readonly BODY_BOUNDED: "nifra.body-bounded";
    readonly CSRF: "nifra.csrf";
    readonly DURABLE_COMMAND: "nifra.durable-command";
    readonly IDEMPOTENCY_KEY: "nifra.idempotency-key";
    readonly IP_RESTRICTED: "nifra.ip-restricted";
    readonly RATE_LIMITED: "nifra.rate-limited";
    readonly SECURITY_HEADERS: "nifra.security-headers";
    readonly RESPONSE_CONTRACT: "nifra.response-contract";
}>;
/** Create evidence with provenance stored non-enumerably so existing route descriptors remain
 * byte-compatible while strict assurance policies can reject author-only assertions. */
export declare function evidenceWithProvenance(id: string, source: string, provenance: "runtime" | "declared"): AssuranceEvidence;
export declare function evidenceProvenance(value: AssuranceEvidence): "runtime" | "declared";
/** Compile an absolute route glob. `*` is one segment; `**` is zero or more segments. */
export declare function routeGlob(pattern: string): RegExp;
/** Validate and freeze declarations, one or many. */
export declare function normalizeAssuranceDeclarations(declaration: AssuranceDeclaration | readonly AssuranceDeclaration[]): readonly AssuranceDeclaration[];
/** Attach enforcement evidence to the middleware/plugin that installs it. */
export declare function withRouteAssurance<T extends object>(target: T, declaration: AssuranceDeclaration | readonly AssuranceDeclaration[]): T;
export declare function assuranceDeclarationsOf(value: object): readonly AssuranceDeclaration[];
export declare function declarationApplies(declaration: AssuranceDeclaration, method: string, path: string): boolean;
export declare function assuranceEvidenceFor(declarationsToApply: readonly AssuranceDeclaration[], method: string, path: string): readonly AssuranceEvidence[];
export declare function validEvidence(value: unknown): value is AssuranceEvidence;
export declare function validEvidenceId(value: string): boolean;
export declare function validMethod(value: string): value is Method;
//# sourceMappingURL=route-assurance.d.ts.map