import type { ApiExtension, ApiModule } from "./module.js";
/**
 * Assemble the anonymous-access allow-list (ADR-0008) from module/extension
 * `anonymous` declarations, unioned with any explicit `publicPaths` the
 * deployment still passes (the escape hatch — e.g. plugin/webhook routes that
 * aren't owned by a module, like a payment-processor callback).
 *
 * For each declaring unit the public mount is `resolveSurfaceMountPath` of its
 * `publicPath`/name under `/v1/public`. `anonymous: true` opens the whole mount;
 * a string array opens specific sub-paths relative to it. Pure and sorted for a
 * deterministic, snapshot-auditable result; the global list is what `requireAuth`
 * matches to skip auth and mark the request as explicitly anonymous.
 */
export declare function assembleAnonymousPaths(modules: readonly ApiModule[], extensions: readonly ApiExtension[], explicit?: readonly string[]): string[];
/**
 * Assemble anonymous paths that use mixed auth: valid customer sessions are
 * resolved, while requests without a valid session continue as explicit guests.
 */
export declare function assembleOptionalCustomerAuthPaths(modules: readonly ApiModule[], extensions: readonly ApiExtension[]): string[];