//#region src/maintenance.d.ts
/**
 * `@platform-modules/util/maintenance` — maintenance-mode guard (pure, zero-dep, web-standard).
 *
 * A pure verdict function (NOT a framework middleware): the host wires the result into its own
 * `Request`→`Response` (Astro / Hono / Worker). No framework coupling (§5 host-agnostic rule).
 *
 * HARD FLOOR — operator escape is non-negotiable: `admin`/`owner` are ALWAYS admitted. The
 * effective allow-set is `(cfg.allowRoles ?? []) ∪ ['admin','owner']`; `cfg.allowRoles` only ADDS
 * roles, it can never REMOVE the operator floor — even `allowRoles:[]` must not lock the operator out.
 */
interface MaintenanceConfig {
  enabled: boolean;
  message?: string;
  allowRoles?: string[];
  retryAfterSec?: number;
}
interface MaintenanceVerdict {
  blocked: boolean;
  status?: 503;
  headers?: Record<string, string>;
  message?: string;
}
declare function maintenanceGuard(cfg: MaintenanceConfig, principalRoles: string[] | null): MaintenanceVerdict;
//#endregion
export { MaintenanceConfig, MaintenanceVerdict, maintenanceGuard };