/**
 * Sandbox-mode helpers for the public `sandbox.neotoma.io` Fly deployment.
 *
 * The sandbox runs with `NEOTOMA_SANDBOX_MODE=1` so unauthenticated callers
 * can write to a shared demo user (`SANDBOX_PUBLIC_USER_ID`) without a bearer
 * token. This file centralises:
 *
 *   - Mode detection (`isSandboxMode`).
 *   - Destructive-op gating (`isDestructiveSandboxRoute`).
 *   - The `X-Neotoma-Sandbox` response-header stamp + mode banner logging.
 *
 * Sandbox data is reset weekly (Sunday 00:00 UTC) by `scripts/reset_sandbox.ts`;
 * see docs/subsystems/sandbox_deployment.md.
 */
import type express from "express";
export declare function isSandboxMode(env?: NodeJS.ProcessEnv): boolean;
export declare function isDestructiveSandboxRoute(path: string): boolean;
/**
 * Mark every response with `X-Neotoma-Sandbox: 1` so clients (especially the
 * Inspector) can detect sandbox mode without an extra API call.
 */
export declare function sandboxHeaderMiddleware(_req: express.Request, res: express.Response, next: express.NextFunction): void;
/**
 * Guard for destructive admin endpoints. Returns a 403 error envelope when
 * sandbox mode is on and the incoming path matches. Otherwise passes through.
 */
export declare function sandboxDestructiveGuard(req: express.Request, res: express.Response, next: express.NextFunction): void;
//# sourceMappingURL=sandbox_mode.d.ts.map