import type { Actor } from "@voyant-travel/core";
import { type AccessCatalog } from "@voyant-travel/types/api-keys";
import type { MiddlewareHandler } from "hono";
import type { AbsoluteClientAuthenticatedRoute } from "../client-authenticated-routes.js";
import type { VoyantBindings, VoyantVariables } from "../types.js";
/**
 * Staff-session RBAC enforcement (member-rbac-rfc, voyant#2085). Enforced **by
 * default**: every member's assigned scope set is checked across admin routes.
 * Full-access members hold `*` and bypass, so they're unaffected. The
 * `VOYANT_RBAC_ENFORCE` env var is a kill switch — set it to `0`/`false`/`off`
 * to disable enforcement (e.g. an emergency rollback) without a code change.
 * API-key scope enforcement is always on (unchanged).
 */
export declare function isStaffRbacEnforced(env: unknown): boolean;
export interface RequireActorOptions {
    /**
     * Deployment prefix stripped before deriving API-key/staff RBAC resources.
     * Keep this aligned with the app-level auth/public-path basePath.
     */
    basePath?: string;
    /** Selected graph mount prefixes whose authorization resource differs from the URL segment. */
    resources?: readonly {
        path: string;
        resource: string;
        authorization?: "coarse" | "route";
    }[];
    accessCatalog?: AccessCatalog;
    /** Exact admin protocol routes that authenticate their client in-band. */
    clientAuthenticatedRoutes?: readonly AbsoluteClientAuthenticatedRoute[];
}
/**
 * Guards a route surface by actor type.
 *
 * Voyant exposes two API surfaces:
 * - `/v1/admin/*` — operator staff (`"staff"`)
 * - `/v1/public/*` — customers, partners, suppliers
 *
 * Requests carry an `actor` on `c.var`, typically set by `requireAuth` or a
 * custom `auth.resolve` integration.
 *
 * When the caller has no resolved actor, this middleware returns `401
 * Unauthorized`. Earlier versions defaulted unset callers to `"staff"` for
 * backwards compatibility, but that meant a misordered or missing auth
 * middleware silently granted operator privileges to anonymous traffic.
 * The default is now fail-closed.
 *
 * @example
 * app.use("/v1/admin/*", requireActor("staff"))
 * app.use("/v1/public/*", requireActor("customer", "partner", "supplier"))
 */
export declare function requireActor<TBindings extends VoyantBindings = VoyantBindings>(...allowed: Actor[]): MiddlewareHandler<{
    Bindings: TBindings;
    Variables: VoyantVariables;
}>;
export declare function requireActor<TBindings extends VoyantBindings = VoyantBindings>(options: RequireActorOptions, ...allowed: Actor[]): MiddlewareHandler<{
    Bindings: TBindings;
    Variables: VoyantVariables;
}>;