/**
 * The dashboard's route → capability table.
 *
 * This is the whole authorization surface of the HTTP API in one readable
 * place, so it can be reviewed without tracing handlers. {@link routePolicy}
 * maps a method and path to the {@link Capability} it needs.
 *
 * **Fails closed.** A route with no entry resolves to `box:shell` — the most
 * privileged capability, admin-only. Adding a route and forgetting to give it a
 * policy therefore locks members out rather than quietly exposing the route.
 *
 * Site-scoped routes take their site from the request body, so their entry sets
 * `siteFrom: 'body'` and the caller supplies the parsed name.
 */
import type { AuthorizationCapability } from '../control-plane';
export interface RoutePolicy {
    capability: AuthorizationCapability;
    /** Resource ancestry used when evaluating the capability. Defaults to project. */
    scope?: 'organization' | 'project' | 'site';
    /** Where the site name comes from, for `site:*` capabilities. */
    siteFrom?: 'body';
    /** Any authenticated user may call it, regardless of role. */
    anyUser?: boolean;
}
/**
 * Routes reachable with no session at all. These necessarily run before there
 * is a user to authorize, so they are listed here explicitly — the set is
 * deliberately tiny and should stay that way.
 *
 * `/login` (the page) is served by the same public path.
 */
export declare const PUBLIC_ROUTES: ReadonlySet<string>;
export declare function isPublicRoute(method: string, pathname: string): boolean;
/**
 * The policy for a request. Unlisted API routes fail closed to admin-only.
 */
export declare function routePolicy(method: string, pathname: string): RoutePolicy;
/** Every policy entry, for tests and documentation. */
export declare function allRoutePolicies(): Record<string, RoutePolicy>;
