/**
 * Route guards — foundation-auth-rbac (Task 11).
 *
 * Thin re-exports of the pure guards from @zync/auth so route files import
 * guards from a single app-local module. They read the verified session that
 * `authMiddleware` placed on `c.get('session')`:
 *   - requirePermission(key) -> 403 if the session lacks the permission.
 *   - requireTier(min)       -> 402 {error:'Upgrade required', requiredTier}.
 *   - requireAdminSession()  -> 401 JSON unless type==='admin' && totp_verified.
 *
 * Admin routes are API (JSON), not browser redirects — requireAdminSession
 * already short-circuits to 401 JSON in @zync/auth.
 */
export { requirePermission, requireTier, requireAdminSession } from '@zync/auth'