/**
 * `/api/dashboard/settings/allowlist` — read/mutate the GitHub OAuth
 * allowlist (`PRZM_CORTEX_DASHBOARD_GITHUB_ALLOWLIST` in the workspace
 * `.env`). Powers the dashboard's Settings → Access page so the
 * operator can add/remove signed-in users without SSHing the box.
 *
 * Surface:
 *   GET    /api/dashboard/settings/allowlist                  → { entries: string[] }
 *   POST   /api/dashboard/settings/allowlist                  → { entries: string[] }
 *     body: { login: string }   (case-insensitive; deduped against existing entries)
 *   DELETE /api/dashboard/settings/allowlist/:login           → { entries: string[] }
 *
 * Auth: every method requires admin scope (the allowlist gates who
 * else can sign in — only admins should be touching it).
 * CSRF: POST/DELETE require `X-Cortex-Dashboard: 1` via the middleware.
 *
 * Persistence: mergeEnv writes atomically (tmp-then-rename) so a
 * concurrent dashboard request can't see a half-written `.env`.
 */
import type { IncomingMessage, ServerResponse } from "node:http";
import type { RouteContext } from "../route-context.js";
export declare function handle(req: IncomingMessage, res: ServerResponse, ctx: RouteContext): Promise<boolean>;
//# sourceMappingURL=dashboard-settings-allowlist.d.ts.map