/**
 * Mutating API routes → minimum capability (single source for server enforce).
 * First matching rule wins. Unlisted mutating routes are not auto-gated here
 * (handlers may still check explicitly; fail-closed for unknown is optional later).
 */
import type { CapabilityId } from './capabilities.js';
export type RouteCapRule = {
    methods: ReadonlyArray<'POST' | 'PUT' | 'PATCH' | 'DELETE'>;
    /** Full path match (no query). */
    pattern: RegExp;
    cap: CapabilityId;
    /** If set, any listed cap satisfies the mutating gate. */
    anyOf?: readonly CapabilityId[];
    /** Optional human note for docs / tests */
    note?: string;
};
/**
 * Critical write / destructive / privilege paths.
 * Order: more specific patterns before broad ones.
 */
export declare const MUTATING_ROUTE_CAP_RULES: readonly RouteCapRule[];
/** Resolve capability for a mutating request, or null if no rule. */
export declare function matchMutatingRouteCap(method: string, pathname: string): CapabilityId | null;
/** Caps that satisfy a mutating rule (any-of), or null if no rule. */
export declare function matchMutatingRouteAnyOf(method: string, pathname: string): CapabilityId[] | null;
/**
 * Authenticated GET inventory → any-of capabilities (viewer factory read caps).
 * Unlisted GETs stay session-only. Agent poller / public / self-service skipped in enforce.
 */
export type GetRouteCapRule = {
    pattern: RegExp;
    caps: readonly CapabilityId[];
    note?: string;
};
export declare const GET_ROUTE_CAP_RULES: readonly GetRouteCapRule[];
/** Resolve any-of caps for a GET, or null if no inventory rule. */
export declare function matchGetRouteCaps(pathname: string): readonly CapabilityId[] | null;
/**
 * Nav / feature key → capabilities required to *see* the item (any-of).
 * Empty / missing → any authenticated user (read surfaces).
 */
export declare const FEATURE_NAV_CAPS: Readonly<Record<string, readonly CapabilityId[]>>;
/** Path prefix → any-of caps (for SPA route guard). Longer prefixes win. */
export declare const PATH_CAP_GUARDS: ReadonlyArray<{
    prefix: string;
    caps: readonly CapabilityId[];
}>;
/** True if actor may see a feature nav item. */
export declare function canSeeFeature(featureKey: string, effective: readonly CapabilityId[] | Set<string>): boolean;
/** SPA path guard — null means no special gate. */
export declare function capsRequiredForPath(pathname: string): readonly CapabilityId[] | null;
export declare function canAccessPath(pathname: string, effective: readonly CapabilityId[] | Set<string>): boolean;
//# sourceMappingURL=route-capabilities.d.ts.map