/**
 * Pure query functions over `AppSurface` data.
 *
 * Usable in tests, the adversarial auth runner, and future surface explorer UI.
 * Replaces duplicated inline `.filter()` patterns.
 *
 * Categorical filters (`filter_authenticated_routes`, `filter_role_routes`,
 * `filter_keeper_routes`) group the new flat-record `RouteAuth` shape into
 * the legacy categorical buckets (`'authenticated'`, `'role'`, `'keeper'`)
 * for adversarial test runners and the surface explorer. The buckets are
 * derived views over the four axes (`account`, `actor`, `roles`,
 * `credential_types`) — see `http/auth_shape.ts` for the canonical shape.
 *
 * @module
 */
import type { AppSurface, AppSurfaceRoute } from './surface.js';
/** Filter routes that require any form of authentication. */
export declare const filter_protected_routes: (surface: AppSurface) => Array<AppSurfaceRoute>;
/** Filter routes that are publicly accessible (no auth surface at all). */
export declare const filter_public_routes: (surface: AppSurface) => Array<AppSurfaceRoute>;
/** Filter all role-guarded routes (any role declared on `auth.roles`). */
export declare const filter_role_routes: (surface: AppSurface) => Array<AppSurfaceRoute>;
/**
 * Filter routes that require basic authentication only — `account === 'required'`
 * with no role / credential gate.
 */
export declare const filter_authenticated_routes: (surface: AppSurface) => Array<AppSurfaceRoute>;
/** Filter routes that require keeper credentials (`daemon_token`). */
export declare const filter_keeper_routes: (surface: AppSurface) => Array<AppSurfaceRoute>;
/** Filter routes whose `auth.roles` includes the named role. */
export declare const filter_routes_for_role: (surface: AppSurface, role: string) => Array<AppSurfaceRoute>;
/**
 * Categorize a `RouteAuth` into one of the legacy auth buckets.
 *
 * Returns:
 * - `'none'` for fully public routes (account === 'none' && actor === 'none')
 * - `'keeper'` when `credential_types` includes `'daemon_token'`
 * - `'role:<name>'` for each role declared on `auth.roles` (multi-role specs
 *   are emitted multiple times; callers that need single-bucket grouping
 *   should pre-collapse)
 * - `'authenticated'` for `account === 'required'` without role / credential gate
 * - `'optional'` when either axis is `'optional'` and no other bucket fits
 * - `'other'` as a last-resort bucket for shapes that don't match above
 */
export type RouteAuthCategory = 'none' | 'authenticated' | 'optional' | 'keeper' | `role:${string}` | 'other';
/**
 * Group routes by auth category (see `RouteAuthCategory`). Multi-role specs
 * appear under each of their role buckets.
 */
export declare const routes_by_auth_type: (surface: AppSurface) => Map<string, Array<AppSurfaceRoute>>;
/** Filter routes whose path starts with `prefix`. */
export declare const filter_routes_by_prefix: (surface: AppSurface, prefix: string) => Array<AppSurfaceRoute>;
/** Filter routes that have a non-null input schema. */
export declare const filter_routes_with_input: (surface: AppSurface) => Array<AppSurfaceRoute>;
/** Filter routes that have a non-null params schema. */
export declare const filter_routes_with_params: (surface: AppSurface) => Array<AppSurfaceRoute>;
/** Filter routes that have a non-null query schema. */
export declare const filter_routes_with_query: (surface: AppSurface) => Array<AppSurfaceRoute>;
/** Filter routes that are mutations (POST, PUT, DELETE, PATCH). */
export declare const filter_mutation_routes: (surface: AppSurface) => Array<AppSurfaceRoute>;
/** Filter routes that declare rate limiting. */
export declare const filter_rate_limited_routes: (surface: AppSurface) => Array<AppSurfaceRoute>;
/** Format a route as `'METHOD /path'` (e.g. `'GET /health'`). */
export declare const format_route_key: (route: AppSurfaceRoute) => string;
/**
 * Summarize route auth distribution across the surface.
 *
 * Categorical view over the four-axis flat record. Multi-role specs
 * contribute one count per role they admit.
 *
 * @returns counts by auth category, with role counts broken out by role name
 */
export declare const surface_auth_summary: (surface: AppSurface) => {
    none: number;
    authenticated: number;
    optional: number;
    role: Map<string, number>;
    keeper: number;
    other: number;
};
//# sourceMappingURL=surface_query.d.ts.map