/**
 * ONE permission wire. Five routes — the pending asks, the decision, the two
 * take-backs, the standing grants — served identically by every surface that
 * mounts them (the umbrella's `/api/vendo`, `agentHandler`'s mount, a host
 * wiring the guard itself), because `@vendoai/ui`'s consent surfaces post to
 * ONE shape and a second hand-rolled copy is how they come to disagree.
 *
 * `undefined` means "not one of mine": the caller falls through to its own
 * table rather than answering not-found on someone else's path.
 */
import { type Json, type Principal } from "@vendoai/core";
import type { VendoGuard } from "./types.js";
export interface PermissionRequest {
    method: "GET" | "POST" | "DELETE";
    /** Mount-relative: `/approvals`, `/approvals/decide`, `/grants/grt_1`, … */
    path: string;
    body?: unknown;
}
export interface PermissionsHandlerDeps {
    guard: VendoGuard;
    principal: (request: Request) => Promise<Principal | null>;
    /** Where these routes are mounted; unset → the umbrella's base path. */
    mount?: string;
}
export declare function handlePermissionRequest(guard: VendoGuard, principal: Principal, request: PermissionRequest): Promise<{
    body: Json;
} | undefined>;
/** The same five routes as a fetch handler, for a host that mounts them itself.
 *  Which AREA a path names is decided before the principal is resolved, so a
 *  neighbour on the same mount (the MCP door) falls through instead of being
 *  challenged for a credential it does not owe this handler. */
export declare function permissionsHandler(deps: PermissionsHandlerDeps): (request: Request) => Promise<Response | undefined>;
//# sourceMappingURL=permission-wire.d.ts.map