/**
 * Whether an entity's plan (its `Config.Features`) allows a capability. Shared by
 * MainAPI and MainUI so the two give the same answer -- MainAPI
 * docs/planning/login-authz-payload.md. MainAPI enforces; MainUI only hides.
 *
 * Pure and dependency-free. The caller passes the feature list and the rule
 * table: the table is owned by MainAPI
 * (`src/core/authorization/catalog/capability-feature-requirements.ts`) and
 * generated into MainUI, so it is never copied into this package.
 *
 * The plan only limits. It never grants: the caller still checks SA, EA or the
 * user's grant.
 */
export declare const PlanFeatureModes: Readonly<{
    readonly ACTIVE: "ACTIVE";
    readonly READ_ONLY: "READ_ONLY";
}>;
/** The entity's `Config.Features`: `{ Key, Mode }` entries; an absent key is a feature the entity lacks. */
export type PlanFeatureList = readonly {
    readonly Key?: unknown;
    readonly Mode?: unknown;
}[] | null | undefined;
/**
 * The features one capability resource (the key without its action) needs.
 * - `Features`: all are required.
 * - `ReadOnlySafe`: the actions still allowed when a required feature is READ_ONLY.
 * - `ActionFeatures`: extra features one action needs.
 */
export interface CapabilityPlanRequirement {
    readonly Features: readonly string[];
    readonly ReadOnlySafe: readonly string[];
    readonly ActionFeatures?: Readonly<Record<string, readonly string[]>>;
}
export type CapabilityPlanRequirements = Readonly<Record<string, CapabilityPlanRequirement>>;
/**
 * The feature-mode primitive: ACTIVE allows any use, READ_ONLY only a
 * read-only-safe one, an absent feature nothing. Direct feature guards (keyless
 * routes, document-dependent writes) call this; `IsAllowedByPlan` is built on it.
 */
export declare function FeatureModeAllows(features: PlanFeatureList, featureKey: string, readOnlySafe: boolean): boolean;
/**
 * Whether the plan allows a capability key (`area.resource.action`). A key whose
 * resource has no entry in `requirements` is denied: every tenant capability has
 * one, with `Features: []` when it needs none. Capabilities outside the table
 * (MainAPI's platform keys) must be exempted by the caller before calling this.
 */
export declare function IsAllowedByPlan(capabilityKey: string, features: PlanFeatureList, requirements: CapabilityPlanRequirements): boolean;