/**
 * HTTP API routes — health, status, sessions, jobs, events.
 *
 * Extracted/simplified from Dawn's 2267-line routes.ts.
 * All the observability you need, none of the complexity you don't.
 */
import { Router } from 'express';
import type { Request as ExpressRequest, Response as ExpressResponse } from 'express';
import type { SessionManager } from '../core/SessionManager.js';
import type { SessionRefresh } from '../core/SessionRefresh.js';
import type { StateManager } from '../core/StateManager.js';
import type { AuthorizationRequestStore } from '../core/AuthorizationRequestStore.js';
import type { JobScheduler } from '../scheduler/JobScheduler.js';
import type { InstarConfig } from '../core/types.js';
import { PlaywrightProfileRegistry } from '../core/PlaywrightProfileRegistry.js';
import { UnjustifiedStopGate } from '../core/UnjustifiedStopGate.js';
import { StopGateDb } from '../core/StopGateDb.js';
import type { TelegramAdapter } from '../messaging/TelegramAdapter.js';
import type { RelationshipManager } from '../core/RelationshipManager.js';
import type { FeedbackManager } from '../core/FeedbackManager.js';
import type { DispatchManager } from '../core/DispatchManager.js';
import type { UpdateChecker } from '../core/UpdateChecker.js';
import type { AutoUpdater } from '../core/AutoUpdater.js';
import type { AutoDispatcher } from '../core/AutoDispatcher.js';
import type { QuotaTracker } from '../monitoring/QuotaTracker.js';
import type { TelegraphService } from '../publishing/TelegraphService.js';
import type { PrivateViewer } from '../publishing/PrivateViewer.js';
import type { TunnelManager } from '../tunnel/TunnelManager.js';
import type { EvolutionManager } from '../core/EvolutionManager.js';
import type { SessionWatchdog } from '../monitoring/SessionWatchdog.js';
import type { StallTriageNurse } from '../monitoring/StallTriageNurse.js';
import type { OrphanProcessReaper } from '../monitoring/OrphanProcessReaper.js';
import type { TopicMemory } from '../memory/TopicMemory.js';
import type { FeedbackAnomalyDetector } from '../monitoring/FeedbackAnomalyDetector.js';
import type { ProjectMapper } from '../core/ProjectMapper.js';
import type { CartographerTree } from '../core/CartographerTree.js';
import type { ProjectDriftChecker } from '../core/ProjectDriftChecker.js';
import type { ScopeVerifier } from '../core/ScopeVerifier.js';
import type { ContextHierarchy } from '../core/ContextHierarchy.js';
import type { CanonicalState } from '../core/CanonicalState.js';
import type { ExternalOperationGate } from '../core/ExternalOperationGate.js';
import type { MessageSentinel } from '../core/MessageSentinel.js';
import type { AdaptiveTrust } from '../core/AdaptiveTrust.js';
import type { AutonomyProfileManager } from '../core/AutonomyProfileManager.js';
import type { TrustElevationTracker } from '../core/TrustElevationTracker.js';
import type { AutonomousEvolution } from '../core/AutonomousEvolution.js';
import type { MemoryPressureMonitor } from '../monitoring/MemoryPressureMonitor.js';
import type { CoherenceMonitor } from '../monitoring/CoherenceMonitor.js';
import type { SystemReviewer } from '../monitoring/SystemReviewer.js';
import type { CommitmentTracker } from '../monitoring/CommitmentTracker.js';
import type { SemanticMemory } from '../memory/SemanticMemory.js';
import type { SessionActivitySentinel } from '../monitoring/SessionActivitySentinel.js';
import type { MessageRouter } from '../messaging/MessageRouter.js';
import type { SessionSummarySentinel } from '../messaging/SessionSummarySentinel.js';
import type { SpawnRequestManager } from '../messaging/SpawnRequestManager.js';
import type { CapabilityMapper } from '../core/CapabilityMapper.js';
import type { SelfKnowledgeTree } from '../knowledge/SelfKnowledgeTree.js';
import type { CoverageAuditor } from '../knowledge/CoverageAuditor.js';
import type { TopicResumeMap } from '../core/TopicResumeMap.js';
import type { WorkingMemoryAssembler } from '../memory/WorkingMemoryAssembler.js';
import type { QuotaManager } from '../monitoring/QuotaManager.js';
import type { ThreadlineRouter } from '../threadline/ThreadlineRouter.js';
import type { HandshakeManager } from '../threadline/HandshakeManager.js';
import type { UnifiedTrustSystem } from '../threadline/UnifiedTrustWiring.js';
import type { HookEventReceiver } from '../monitoring/HookEventReceiver.js';
import type { WorktreeMonitor } from '../monitoring/WorktreeMonitor.js';
import type { SubagentTracker } from '../monitoring/SubagentTracker.js';
import type { InstructionsVerifier } from '../monitoring/InstructionsVerifier.js';
import type { CoherenceGate } from '../core/CoherenceGate.js';
import type { MessagingToneGate } from '../core/MessagingToneGate.js';
import type { PasteManager } from '../paste/PasteManager.js';
import type { WebSocketManager } from './WebSocketManager.js';
/**
 * Build the /whoami request handler.
 *
 * Spec docs/specs/telegram-delivery-robustness.md § Layer 1c. Exported
 * separately from createRoutes so unit tests can mount it on a minimal
 * Express app without instantiating the entire RouteContext.
 *
 * Behavior:
 *   - 403 `{error: 'agent_id_header_required'}` when X-Instar-AgentId is
 *     absent. The middleware accepts bare-token requests during the
 *     deprecation window for *other* endpoints; /whoami does not, because
 *     accepting a bare-token request here would let a caller learn the
 *     expected agent-id from the response (discovery oracle).
 *   - 403 `{error: 'agent_id_mismatch', expected}` when the header is
 *     present but does not match.
 *   - 429 with retry hint when the per-source rate limit (1 req/s) is
 *     exceeded — the bucket is keyed on (agent-id, remoteAddress) so a
 *     single misbehaving caller can't starve the budget for legitimate
 *     sentinel callers from other source addresses.
 *   - 200 `{agentId, port}` on a clean request. (We deliberately do NOT
 *     return `version`: an authed identity probe shouldn't double as a
 *     CVE-targeting oracle for an authed peer who has stolen a token.)
 */
export declare function createWhoamiHandler(opts: {
    agentId: string;
    port: number;
    configVersion?: string;
}): (req: ExpressRequest, res: ExpressResponse) => void;
/**
 * Build the `POST /events/delivery-failed` request handler.
 *
 * Spec: docs/specs/telegram-delivery-robustness.md § Layer 2c.
 *
 * Contract:
 *   - Body: `{ delivery_id, topic_id, text_hash, http_code,
 *              error_body?, attempted_port, attempts }` — strict
 *     (any extra field rejected with 400).
 *   - Caps: text-equivalent fields ≤ 8KB, error_body ≤ 1KB, total
 *     body ≤ 16KB. The endpoint *does not store anything* — the
 *     SQLite queue on the script side is the durable record. This
 *     route only fans out an SSE event so listeners (the Layer 3
 *     sentinel, the dashboard) can react in real time.
 *   - Per-(agentId, remote) token bucket: 10 req/s sustained, burst 50.
 *   - Auth handled by upstream `authMiddleware`; we additionally
 *     reject responses missing `X-Instar-AgentId` so the auth-mismatch
 *     path returns the same structured 403 even when the route is
 *     mounted in tests without the full middleware stack.
 *
 * Validation is hand-rolled (rather than zod) for two reasons:
 *   (1) the schema is small and we want every failure mode to map to a
 *       precise error code without translating zod's verbose message
 *       shape; (2) zod is in deps but adds a non-trivial import-time
 *       cost on a hot route.
 */
export declare function createDeliveryFailedHandler(opts: {
    agentId: string;
    emit?: (event: Record<string, unknown>) => void;
    /** Override clock for tests; defaults to `Date.now`. */
    now?: () => number;
}): (req: ExpressRequest, res: ExpressResponse) => void;
export interface RouteContext {
    config: InstarConfig;
    /** Live-config READ handle (mtime-staleness re-reader). Routes that must
     *  honor config flips WITHOUT a restart (outbound-advisory rollback
     *  contract — spec outbound-jargon-filepath-gap §5) read through this.
     *  Null on older callers/tests → consumers fall back to code defaults. */
    liveConfig?: {
        get<T>(path: string, def: T): T;
    } | null;
    /** Validates an X-Instar-DeliveryId against an ACTUAL PendingRelayStore
     *  row — the §2.1 redrive exemption for the kindless-job-send breadcrumb
     *  (a fabricated header must not buy the exemption). Wired by AgentServer
     *  when the delivery sentinel's store opens; absent → no exemption. */
    pendingRelayLookup?: (deliveryId: string) => boolean;
    sessionManager: SessionManager;
    state: StateManager;
    scheduler: JobScheduler | null;
    telegram: TelegramAdapter | null;
    relationships: RelationshipManager | null;
    feedback: FeedbackManager | null;
    dispatches: DispatchManager | null;
    updateChecker: UpdateChecker | null;
    autoUpdater: AutoUpdater | null;
    autoDispatcher: AutoDispatcher | null;
    quotaTracker: QuotaTracker | null;
    publisher: TelegraphService | null;
    viewer: PrivateViewer | null;
    tunnel: TunnelManager | null;
    evolution: EvolutionManager | null;
    watchdog: SessionWatchdog | null;
    triageNurse: StallTriageNurse | null;
    topicMemory: TopicMemory | null;
    feedbackAnomalyDetector: FeedbackAnomalyDetector | null;
    projectMapper: ProjectMapper | null;
    cartographer?: CartographerTree | null;
    coherenceGate: ScopeVerifier | null;
    contextHierarchy: ContextHierarchy | null;
    canonicalState: CanonicalState | null;
    operationGate: ExternalOperationGate | null;
    sentinel: MessageSentinel | null;
    adaptiveTrust: AdaptiveTrust | null;
    memoryMonitor: MemoryPressureMonitor | null;
    orphanReaper: OrphanProcessReaper | null;
    coherenceMonitor: CoherenceMonitor | null;
    commitmentTracker: CommitmentTracker | null;
    /** PrHandLease — per-branch push-ownership lease so two of the agent's own
     *  concurrent sessions can't push competing commits to the same branch.
     *  Null until dev-gated construction in server.ts (spec: parallel-hand-pr-lease). */
    prHandLease?: import('../core/PrHandLease.js').PrHandLease | null;
    /** SubscriptionPool (multi-account subscription registry, P1.1 of the
     *  Subscription & Auth Standard). Null until an operator opts in / enrolls. */
    subscriptionPool: import('../core/SubscriptionPool.js').SubscriptionPool | null;
    /** WS5.2 Account Follow-Me — cross-machine per-peer account views for depth detection. Prod-wired
     *  to the `?scope=pool` fan-out; absent ⇒ local-only (single-machine = no depth-zero peers). */
    accountFollowMePeerViews?: () => Promise<import('../core/accountFollowMeDepth.js').MachinePoolView[]>;
    /** QuotaPoller (P1.2) — per-account live quota reader. Null until wired. */
    quotaPoller: import('../core/QuotaPoller.js').QuotaPoller | null;
    /** QuotaAwareScheduler (P1.3) — account selection + swap-and-resume guarantee. */
    quotaAwareScheduler: import('../core/QuotaAwareScheduler.js').QuotaAwareScheduler | null;
    /** ProactiveSwapMonitor (P1.3, pre-limit half) — moves a session off an account
     *  BEFORE it walls. Optional; the routes report enabled:false when absent. */
    proactiveSwapMonitor?: import('../core/ProactiveSwapMonitor.js').ProactiveSwapMonitor;
    /** InUseAccountResolver — which pool account the agent is currently running on
     *  (for the dashboard "in use" badge). Optional; the route lazily constructs a
     *  default when absent so it never 503s. */
    inUseAccountResolver?: import('../core/InUseAccountResolver.js').InUseAccountResolver;
    /** EnrollmentWizard (P2.1) — mobile-first login + auto-reissue. Null until wired. */
    enrollmentWizard: import('../core/EnrollmentWizard.js').EnrollmentWizard | null;
    /** WS5.2 R12 — Account Follow-Me revocation data-plane executor. Constructed in the server with
     *  REAL deps (cooperative local wipe + durable pending store + attention emit). Null when the
     *  server wiring did not construct it (e.g. lightweight test harnesses). The `/mandate/:id/revoke`
     *  route fires this for an `account-follow-me` mandate; everything is DARK behind
     *  `multiMachine.accountFollowMe` (revoke() is a strict no-op when the gate resolves off). */
    accountFollowMeRevocation?: import('../core/AccountFollowMeRevocation.js').AccountFollowMeRevocation | null;
    /** Live credential re-pointing (WS5.2) — the swap/set-default/restore-enrollment levers
     *  + ledger census + audit-scrub chokepoint. Null until the server wiring constructs it;
     *  ships DARK behind `subscriptionPool.credentialRepointing.enabled` (the routes 503 /
     *  no-op when the flag is off, regardless of whether this bundle is wired). */
    credentialRepointing?: {
        ledger: import('../core/CredentialLocationLedger.js').CredentialLocationLedger;
        /** Constructs+runs the staged exchange live (the Step-5 executor host). */
        swapExecutor: import('../core/CredentialSwapExecutor.js').CredentialSwapExecutor;
        /** Slot → confirmed accountId | unavailable (the composed oracle→pool resolver). */
        resolveIdentity: import('../core/CredentialSwapExecutor.js').ResolveSlotIdentity;
        /** The SINGLE secret-scrub chokepoint every response/audit/attention routes through. */
        audit: import('../core/CredentialAuditEmit.js').CredentialAuditEmit;
        /** Per-pair cooldown + §0.g force budget. */
        levers: import('../core/CredentialManualLevers.js').CredentialManualLevers;
        /** §2.10 env-token gate (Step 8) — refuses the feature (config field OR live env-token fleet)
         *  with a named reason surfaced on GET /credentials/rebalancer. */
        envTokenGate: import('../core/CredentialEnvTokenGate.js').CredentialEnvTokenGate;
        /** B3b — the autonomous balancer (Increment B). Its `status()` is surfaced on
         *  GET /credentials/rebalancer (last pass + breaker). Optional so tests can omit it. */
        rebalancer?: import('../core/CredentialRebalancer.js').CredentialRebalancer;
        /** Raw-blob reader for a slot (restore-enrollment coherence probe). Injectable for tests. */
        readBlob?: (slot: string) => Promise<{
            raw: string;
            oauth: import('../core/OAuthRefresher.js').ClaudeOauth | null;
        } | null>;
    } | null;
    semanticMemory: SemanticMemory | null;
    activitySentinel: SessionActivitySentinel | null;
    rateLimitSentinel: import('../monitoring/RateLimitSentinel.js').RateLimitSentinel | null;
    /** ReleaseReadinessSentinel (Layer B of release-readiness-visibility). Null on
     *  installs with no analyzable instar git repo, or when disabled in config. */
    releaseReadinessSentinel: import('../monitoring/ReleaseReadinessSentinel.js').ReleaseReadinessSentinel | null;
    /** GreenPrAutoMerger (green-pr-automerge-enforcement). Null on installs with no
     *  analyzable instar repo + safe-merge, or when disabled in config. */
    greenPrAutoMerger: import('../monitoring/GreenPrAutoMerger.js').GreenPrAutoMerger | null;
    /** GuardLatchStore — the pool-visible rollback/enable/pool-armed latches. */
    guardLatchStore: import('../monitoring/GuardLatchStore.js').GuardLatchStore | null;
    messageRouter: MessageRouter | null;
    summarySentinel: SessionSummarySentinel | null;
    spawnManager: SpawnRequestManager | null;
    workingMemory: WorkingMemoryAssembler | null;
    quotaManager: QuotaManager | null;
    systemReviewer: SystemReviewer | null;
    capabilityMapper: CapabilityMapper | null;
    selfKnowledgeTree: SelfKnowledgeTree | null;
    coverageAuditor: CoverageAuditor | null;
    topicResumeMap: TopicResumeMap | null;
    /** Topic Profile (TOPIC-PROFILE-SPEC §10.1/§12) — store + resolver + write
     *  surface + shared confirm slots behind GET/POST /topic-profile/:topicId.
     *  Null when the profile store failed to initialize; the routes then report
     *  unwired honestly (503). */
    topicProfile?: {
        store: import('../core/TopicProfileStore.js').TopicProfileStore;
        resolver: import('../core/TopicProfileResolver.js').TopicProfileResolver;
        surface: import('../core/topicProfileWriteSurface.js').TopicProfileWriteSurface;
        confirmSlots: import('../core/topicProfileIngress.js').ProfileConfirmSlots;
        /** §8 orchestrator — the model-swap route serializes its live-session
         *  mutation through orchestrator.runExclusive (the §5.1/§9 per-topic
         *  lock pass-through). Null until the server wiring constructs it. */
        orchestrator?: import('../core/TopicProfileOrchestrator.js').TopicProfileOrchestrator | null;
        /** §5.3 transfer carrier — read-surface staleness (`pendingTransferPull`)
         *  + the /pool/transfer acquire seam. Null on single-machine installs. */
        carrier?: import('../core/TopicProfileTransferCarrier.js').TopicProfileTransferCarrier | null;
    } | null;
    /** Playwright Profile Registry (docs/specs/playwright-profile-registry.md) —
     *  optional factory override. Production constructs the registry per-request
     *  from `ctx.config` (mirroring how the self-knowledge route builds
     *  BootSelfKnowledge per request, so flags + the vault-name list are always
     *  read FRESH from disk). Tests inject this to control listVaultNames /
     *  hostname hermetically. When absent the route builds the default. */
    playwrightRegistry?: () => PlaywrightProfileRegistry;
    /** Agent-initiated session respawn. Null when no Telegram adapter is
     *  wired (v1 requires a Telegram-bound session). */
    sessionRefresh: SessionRefresh | null;
    /** Model-Tier Escalation §5.3 (FABLE-MODEL-ESCALATION-SPEC) — the
     *  server-side mid-session swap engine behind POST /sessions/:name/
     *  model-swap. Null only when no SessionManager exists; the route then
     *  reports unwired honestly (503). */
    modelTierSwap?: import('../core/ModelSwapService.js').ModelSwapService | null;
    /** WS5.3 (escalation-rides-topic) — the ephemeral per-topic escalation-hint
     *  carrier. The `/pool/transfer` SOURCE leg files a hint when the moving
     *  topic has a live escalated session; the destination resume/acquire pull
     *  consumes it to RE-ADMIT through its own governor. Null on single-machine
     *  installs or when WS5.3 is unwired (the path is then a strict no-op). */
    escalationHints?: import('../core/EscalationHintStore.js').EscalationHintStore | null;
    autonomyManager: AutonomyProfileManager | null;
    trustElevationTracker: TrustElevationTracker | null;
    autonomousEvolution: AutonomousEvolution | null;
    whatsapp: import('../messaging/WhatsAppAdapter.js').WhatsAppAdapter | null;
    slack: import('../messaging/slack/SlackAdapter.js').SlackAdapter | null;
    imessage: import('../messaging/imessage/IMessageAdapter.js').IMessageAdapter | null;
    messageBridge: import('../messaging/shared/MessageBridge.js').MessageBridge | null;
    hookEventReceiver: HookEventReceiver | null;
    worktreeMonitor: WorktreeMonitor | null;
    subagentTracker: SubagentTracker | null;
    instructionsVerifier: InstructionsVerifier | null;
    threadlineRouter: ThreadlineRouter | null;
    /** Threadline Phase 1 keystone — the Conversation single-source-of-truth and
     *  the warrants-a-reply gate, exposed on ctx so the LOCAL co-located inbound
     *  path (/messages/relay-agent) gates identically to the relay funnel. Without
     *  this, same-machine agents bypass the loop gate (caught in test-as-self). */
    conversationStore?: import('../threadline/ConversationStore.js').ConversationStore;
    /** Robustness Phase 2 (D-A) — the canonical, append-only, hash-chained
     *  per-thread log. The authoritative read source for `threadline_history` and
     *  the structural F3 fix. Optional; absent when threadline is disabled. */
    threadLog?: import('../threadline/ThreadLog.js').ThreadLog;
    /** Robustness Phase 2 (D-B/D-E) — the single append funnel + conversation
     *  -discipline resolver. Every message-persisting route appends through this. */
    threadMessageRecorder?: import('../threadline/recordThreadMessage.js').ThreadMessageRecorder;
    warrantsReplyGate?: import('../threadline/WarrantsReplyGate.js').WarrantsReplyGate;
    /** CMT-509: surface parentless Threadline conversations to a dedicated topic. */
    collaborationSurfacer?: import('../threadline/CollaborationSurfacer.js').CollaborationSurfacer;
    /** ThreadResumeMap — exposed on ctx so /threadline/relay-send can stamp
     *  originTopicId on outbound sends. Per THREAD-TOPIC-LINKAGE-SPEC.md. */
    threadResumeMap: import('../threadline/ThreadResumeMap.js').ThreadResumeMap | null;
    /** TopicLinkageHandler — drives outbound capture + inbound topic-routing.
     *  Optional; null when threadline is disabled. */
    topicLinkageHandler: import('../threadline/TopicLinkageHandler.js').TopicLinkageHandler | null;
    handshakeManager: HandshakeManager | null;
    threadlineRelayClient: import('../threadline/client/ThreadlineClient.js').ThreadlineClient | null;
    listenerManager: import('../threadline/ListenerSessionManager.js').ListenerSessionManager | null;
    /** Durable A2A delivery lifecycle + peer-health (A2A-DURABLE-DELIVERY-SPEC.md).
     *  Recording-only — never gates a send. Null only if SQLite open failed. */
    a2aDeliveryTracker: import('../threadline/A2ADeliveryTracker.js').A2ADeliveryTracker | null;
    responseReviewGate: CoherenceGate | null;
    /** Scoped tone gate for outbound agent-to-user messaging routes.
     *  Uses the shared IntelligenceProvider (Claude CLI subscription or Anthropic API).
     *  Catches CLI commands, file paths, config syntax leaking to users. */
    messagingToneGate: MessagingToneGate | null;
    /** Layer 3 of the Topic Intent Layer — pre-send arc-check. Same instance
     *  is wired behind the HTTP route (createTopicIntentRoutes) and consumed
     *  in-process by checkOutboundMessage so the tone gate sees ArcCheck's
     *  signal alongside junk/jargon/duplicate. Null when disabled. */
    topicIntentArcCheck: import('../core/TopicIntentArcCheck.js').ArcCheck | null;
    /** Usher signal store (rung 4). Used by the outbound-reply path to credit a
     *  re-surface nudge the agent's reply actually used (precision numerator,
     *  path (a)). Optional/null when the Usher is disabled. */
    usherSignalStore?: import('../core/UsherSignalStore.js').UsherSignalStore | null;
    /** Deterministic dedup gate. Blocks near-duplicate outbound messages in
     *  the same conversation — universal safety net against respawn races,
     *  idempotency gaps, and other lifecycle hazards. No LLM call, runs on
     *  every outbound message. */
    outboundDedupGate: import('../core/OutboundDedupGate.js').OutboundDedupGate | null;
    telemetryHeartbeat: import('../monitoring/TelemetryHeartbeat.js').TelemetryHeartbeat | null;
    pasteManager: PasteManager | null;
    wsManager: WebSocketManager | null;
    soulManager: import('../core/SoulManager.js').SoulManager | null;
    featureRegistry: import('../core/FeatureRegistry.js').FeatureRegistry | null;
    discoveryEvaluator: import('../core/DiscoveryEvaluator.js').DiscoveryEvaluator | null;
    /** Independent autonomous-completion judge (mirrors /goal). Null if no IntelligenceProvider. */
    completionEvaluator: import('../core/CompletionEvaluator.js').CompletionEvaluator | null;
    /** Live-user-channel-proof completion gate (§4) — vetoes "done" for a user-facing
     *  feature without a verified live-test artifact. Null when dark/unwired. */
    liveTestGate: import('../core/LiveTestGate.js').LiveTestGate | null;
    liveTestGateMode: import('../core/LiveTestGate.js').LiveTestGateMode;
    /** Live-user-channel-proof CAPSTONE runner wiring (§6/§7.5). Null when dark/unwired —
     *  the /live-test/* routes 503 then. A factory so the route wraps the request-built driver. */
    liveTestRunnerCtx: import('./AgentServer.js').LiveTestRunnerWiring | null;
    unifiedTrust: UnifiedTrustSystem | null;
    /** Shared proxy coordinator — mutex + /build heartbeat record for the
     *  PresenceProxy ↔ PromiseBeacon ↔ /build-heartbeat three-way deconfliction
     *  (BUILD-STALL-VISIBILITY-SPEC Fix 2 "Routing"). */
    proxyCoordinator: import('../monitoring/ProxyCoordinator.js').ProxyCoordinator | null;
    /** Integrated-Being SharedStateLedger (v1). Null when disabled. */
    sharedStateLedger: import('../core/SharedStateLedger.js').SharedStateLedger | null;
    /** Integrated-Being LedgerSessionRegistry (v2). Null when v2Enabled=false. */
    ledgerSessionRegistry: import('../core/LedgerSessionRegistry.js').LedgerSessionRegistry | null;
    /** Initiative tracker — persisted record of multi-phase long-running work. */
    initiativeTracker: import('../core/InitiativeTracker.js').InitiativeTracker | null;
    /** Project-scope round runner (Phase 1b PR 3). Single chokepoint for
     *  /advance, /halt, /ack, /accept-partial. Null when initiativeTracker
     *  is also null. */
    projectRoundRunner: import('../core/ProjectRoundRunner.js').ProjectRoundRunner | null;
    /** Project drift checker (Phase 1b connect-the-dots). Null when no
     *  IntelligenceProvider is configured (then POST /projects/:id/drift-check
     *  returns 503). */
    projectDriftChecker: ProjectDriftChecker | null;
    /** Machine heartbeat (Phase 1b PR 4). Bundled with `config.machineId`
     *  so the claim-ownership route can compare against the current
     *  machine without a separate top-level field. Null when running in
     *  single-machine mode. */
    machineHeartbeat: {
        api: import('../core/MachineHeartbeat.js').MachineHeartbeat;
        config: {
            machineId: string;
        };
    } | null;
    /** Threadline → Telegram bridge config — toggles + allow/deny list. Read by
     *  /threadline/telegram-bridge/config endpoints and by the bridge module
     *  to decide whether to mirror an inbound message into
     *  a Telegram topic. Null when LiveConfig is not wired. */
    telegramBridgeConfig: import('../threadline/TelegramBridgeConfig.js').TelegramBridgeConfig | null;
    /** Threadline → Telegram bridge — mirrors threadline messages into per-thread
     *  Telegram topics. RELAY-ONLY: never blocks routing, swallows its own
     *  errors. Null when no Telegram adapter is wired. */
    telegramBridge: import('../threadline/TelegramBridge.js').TelegramBridge | null;
    /** Threadline observability — read-only view layer over inbox/outbox/bindings.
     *  Powers the dashboard Threadline tab via /threadline/observability/*. */
    threadlineObservability: import('../threadline/ThreadlineObservability.js').ThreadlineObservability | null;
    /** CMT-567: shared deps for the "open this" LLM topic-name + summary brief.
     *  Built once at server startup; the hub/bind route + the structural intercept
     *  share it. Null sub-deps degrade to template/slug. */
    briefDeps: import('../threadline/openConversationBrief.js').BriefDeps | null;
    /** Pending reply waiters for threadline relay-send waitForReply support.
     *  Key: threadId (UUID — unique per conversation, unlike agent names which
     *  can collide when multiple agents share a name). Value: resolve callback
     *  with reply text. */
    threadlineReplyWaiters: Map<string, {
        resolve: (reply: string) => void;
        threadId: string;
        senderAgent: string;
        timer: ReturnType<typeof setTimeout>;
    }>;
    /** UnjustifiedStopGate authority (PR3 — context-death spec). Null
     *  when no intelligence provider is configured; the evaluate route
     *  fail-opens in that case. */
    unjustifiedStopGate: UnjustifiedStopGate | null;
    /** Stop-gate SQLite persistence (PR3). Null when not initialized;
     *  the evaluate route will still produce a response, just without
     *  persistence. */
    stopGateDb: StopGateDb | null;
    /** notify-on-stop Layer B — surfaces a genuinely-stuck unattended stop to the
     *  user (coalesced via SentinelNotifier). Null when telegram isn't wired; the
     *  evaluate route simply skips the notice. */
    stopNotifier: import('../monitoring/StopNotifier.js').StopNotifier | null;
    /** Token-usage ledger (read-only observability over Claude Code JSONL
     *  transcripts). Null when stateDir is unavailable. */
    tokenLedger: import('../monitoring/TokenLedger.js').TokenLedger | null;
    featureMetricsLedger: import('../monitoring/FeatureMetricsLedger.js').FeatureMetricsLedger | null;
    resourceLedger: import('../monitoring/ResourceLedger.js').ResourceLedger | null;
    /** Approval-as-Data ledger (spec Part B / Phase 2). Records operator approval
     *  decisions + per-class agreement ratios. Null when stateDir is unavailable. */
    approvalLedger: import('../core/ApprovalLedger.js').ApprovalLedger | null;
    /** Verified per-topic operator binding (Know Your Principal #898, increment 2).
     *  The principal whose decisions the agent enacts, established only from the
     *  authenticated sender uid. Null when stateDir is unavailable. */
    topicOperatorStore: import('../users/TopicOperatorStore.js').TopicOperatorStore | null;
    /** Coordination Mandate enforcement (docs/specs/coordination-mandate.md §4).
     *  Deny-by-default gate + signed store + hash-chained audit. Null when stateDir
     *  is unavailable. Issuance/revocation are PIN-gated, never Bearer-only. */
    coordination: {
        store: import('../coordination/MandateStore.js').MandateStore;
        gate: import('../coordination/MandateGate.js').MandateGate;
        audit: import('../coordination/MandateAudit.js').MandateAudit;
        /** ReviewExchange engine (spec §7 G2.3) — mandate-gated mutual code-review sign-offs. */
        reviews: import('../coordination/ReviewExchange.js').ReviewExchangeEngine;
    } | null;
    /** WS5.2 R4a — ONE-DASHBOARD cross-machine account-follow-me mandate delivery.
     *  Durable store of mandates DELIVERED+VERIFIED to THIS machine from the operator machine; the
     *  enroll-start route consults it (re-verifying at point-of-use) when no LOCAL mandate authorizes.
     *  Null/absent when account follow-me is dark on this agent. */
    deliveredMandateStore?: import('../coordination/DeliveredMandateStore.js').DeliveredMandateStore | null;
    /** WS5.2 R4a — re-verify a delivered mandate AT POINT OF USE (defense-in-depth — never trust a
     *  stored flag). Returns the verified bounds when the persisted PortableMandate's asymmetric
     *  issuance signature STILL verifies against the registered operator-machine key recorded at
     *  delivery; null on any failure (fail-closed). Injected so the dangerous re-check is a real check.
     *  Absent ⇒ the delivered-mandate path is inert (the route falls back to deny-by-default). */
    verifyDeliveredMandate?: ((mandateId: string) => {
        accountId: string;
        targetMachineId: string;
        mechanism: string;
    } | null) | null;
    /** WS5.2 R4a — operator/issuer side: deliver an issued account-follow-me mandate to a REMOTE
     *  target machine over the signed mesh (the new verb). Resolves the target's mesh address +
     *  signs the envelope with THIS machine's Ed25519 identity key. Returns the per-target outcome.
     *  Absent/null when this machine cannot deliver (no mesh identity / single-machine). */
    deliverMandateToMachine?: ((args: {
        targetMachineId: string;
        portable: import('../coordination/AccountFollowMeMandateBridge.js').PortableMandate;
    }) => Promise<{
        ok: boolean;
        status: number;
        reason?: string;
    }>) | null;
    /** WS5.2 R4a — sign an issued mandate for cross-machine delivery (operator side): produce the
     *  R4a PortableMandate (mandate + asymmetric issuance signature) with THIS machine's Ed25519
     *  identity key + fingerprint. Absent/null when this machine has no mesh identity. */
    packageMandateForDelivery?: ((mandate: import('../coordination/types.js').CoordinationMandate) => import('../coordination/AccountFollowMeMandateBridge.js').PortableMandate) | null;
    /** Operator Authorization Request (agent proposes → operator approves one-tap).
     *  Spec: docs/specs/OPERATOR-AUTHORIZATION-REQUEST-SPEC.md. Null when stateDir is
     *  unavailable. `enabled` is the resolved dev-gate (enabled-on-dev / dark-on-fleet);
     *  the routes 503 when false. `resolvePrincipal` is the SAME registry the
     *  SlackPermissionGate consumes (UserManager.resolveFromSlackUserId). The approve
     *  route issues the grant via ctx.coordination.store — never a new authority path. */
    authorizationRequests?: {
        store: AuthorizationRequestStore;
        enabled: boolean;
        machineId: string;
        ownerDisplay: string;
        carrierSelfFp: string;
        resolvePrincipal: (slackUserId: string) => {
            name: string;
            registered: boolean;
        } | null;
    } | null;
    /** Cutover-READINESS checker (spec §7 G2.4, decision 1A: everything UP TO the
     *  door). Read-only objective conditions from durable state; the flip itself is
     *  never autonomous. Null when stateDir is unavailable. */
    cutoverReadiness: import('../feedback-factory/cutoverReadiness.js').CutoverReadiness | null;
    /** Option-B receiving end (feedback-factory-migration Q2b): the Blob-inbox →
     *  durable canonical store drainer. Null when dark (config off / no token) →
     *  GET /feedback-inbox/status 503s. */
    inboxDrainer?: import('../feedback-factory/inbox/InboxDrainer.js').InboxDrainer | null;
    /** Feedback-factory processing trigger (feedback-factory-migration §191). Backs
     *  GET /feedback-factory/stats + POST /feedback-factory/process. Null when
     *  dev-gate dark (feedbackFactory.processing) → both routes 503. */
    feedbackProcessing?: import('../feedback-factory/processing/FeedbackProcessingService.js').FeedbackProcessingService | null;
    /** Cross-topic activity index (Parallel-Work Awareness Phase A). Backs GET /parallel-work/activities. */
    parallelActivityIndex?: import('../core/ParallelActivityIndex.js').ParallelActivityIndex | null;
    /** The shared intelligence provider (an IntelligenceRouter when per-component routing is wired). Backs GET /intelligence/routing. */
    intelligence?: import('../core/types.js').IntelligenceProvider | null;
    /** Framework-Onboarding Mentor System issue ledger (read-only observability;
     *  signal-only — never gates). Null when stateDir is unavailable. Powers
     *  GET /framework-issues and /framework-issues/playbook. */
    frameworkIssueLedger?: import('../monitoring/FrameworkIssueLedger.js').FrameworkIssueLedger | null;
    /** Mentor-onboarding runner (§19.4). Null when not wired. Ships dormant
     *  (mentor.enabled=false); powers GET /mentor/status + POST /mentor/tick. */
    mentorRunner?: import('../scheduler/MentorOnboardingRunner.js').MentorOnboardingRunner | null;
    /** Failure-Learning Loop ledger + attribution engine (instar dev-process
     *  forensics). Null/absent when the feature is disabled (default) → /failures 503s. */
    failureLedger?: import('../monitoring/FailureLedger.js').FailureLedger | null;
    failureAttributionEngine?: import('../monitoring/FailureAttributionEngine.js').FailureAttributionEngine | null;
    /** Correction & Preference Learning Sentinel ledger (distilled, scrubbed
     *  records only). Null/absent when monitoring.correctionLearning.enabled is
     *  false (default) → /corrections 503s. */
    correctionLedger?: import('../monitoring/CorrectionLedger.js').CorrectionLedger | null;
    /** BlockerLedger — the resolution-workflow + memory layer completing Principle 1.
     *  Null/absent when monitoring.blockerLedger.enabled is false (default, ships dark)
     *  → /blockers/* 503s. Powers GET /blockers, GET /blockers/:id, POST /blockers,
     *  POST /blockers/:id/advance, POST /blockers/:id/settle. Signal-only — it never
     *  blocks a message; the true-blocker settle routes through the B17 authority. */
    blockerLedger?: import('../monitoring/BlockerLedger.js').BlockerLedger | null;
    /** Self-Unblock checklist run store ("Self-Unblock Before Escalating", §5/§7).
     *  Null/absent when monitoring.blockerLedger.selfUnblockChecklist.enabled is false
     *  (default, ships dark) → GET /blockers/self-unblock-runs 503s (after auth). The
     *  read-only view of recent checklist runs + the rung. */
    selfUnblockRunStore?: import('../monitoring/SelfUnblockChecklist.js').SelfUnblockRunStore | null;
    /** The PRODUCTION Self-Unblock checklist — real probe providers + the run store.
     *  Null/absent when the self-unblock sub-feature is dark → POST /blockers/self-unblock-run
     *  503s (after auth). The PRODUCER surface: running it produces the verified run a
     *  true-blocker settle requires (closing the gap where no run could be produced). */
    selfUnblockChecklist?: import('../monitoring/SelfUnblockChecklist.js').SelfUnblockChecklist | null;
    /** GrowthMilestoneAnalyst — the proactive growth & milestone analyst. Null/absent
     *  when monitoring.growthAnalyst.enabled is false (default, ships dark) →
     *  /growth/* 503s. Powers GET /growth/digest, GET /growth/findings,
     *  GET /growth/status, POST /growth/tick. */
    growthMilestoneAnalyst?: import('../monitoring/GrowthMilestoneAnalyst.js').GrowthMilestoneAnalyst | null;
    /** Slice-2 proactive growth-digest publisher (cadence + delivery). Null/absent
     *  when digestDelivery is 'off' or the analyst is unwired. The route layer
     *  attaches its guarded sender (`postToUpdatesTopic`) via `attachSender` at
     *  registration so the publisher shares the single `evaluateOutbound` funnel. */
    growthDigestPublisher?: import('../monitoring/GrowthDigestPublisher.js').GrowthDigestPublisher | null;
    /** Apprenticeship Program registry + lifecycle gates (Apprenticeship Step 1).
     *  Null when stateDir is unavailable → /apprenticeship/* 503s. Powers the
     *  instance-as-project registry, the retro-gate (pending→active) and the
     *  doc-as-required-artifact gate (active→complete). */
    apprenticeshipProgram?: import('../core/ApprenticeshipProgram.js').ApprenticeshipProgram | null;
    /** Apprenticeship differential-cycle store. Null when SQLite/state init fails
     *  → /apprenticeship/cycles* 503s. */
    apprenticeshipCycleStore?: import('../monitoring/ApprenticeshipCycleStore.js').ApprenticeshipCycleStore | null;
    /** Observe-only overdue-cycle SLA monitor. Null when disabled/unavailable. */
    apprenticeshipCycleSlaMonitor?: import('../monitoring/ApprenticeshipCycleSlaMonitor.js').ApprenticeshipCycleSlaMonitor | null;
    /** Observe-only Gemini long-capacity-block escalation monitor. Null when disabled.
     *  → GET /gemini/capacity 503s. */
    geminiCapacityEscalationMonitor?: import('../monitoring/GeminiCapacityEscalationMonitor.js').GeminiCapacityEscalationMonitor | null;
    /** SessionReaper — pressure-aware idle-session reaper. Null when not wired
     *  (older boot paths). Powers GET /sessions/reaper observability. */
    sessionReaper?: import('../monitoring/SessionReaper.js').SessionReaper | null;
    reapLog?: import('../monitoring/ReapLog.js').ReapLog | null;
    /** ResumeQueue + drainer (reap-notify spec R2.10). Null when Part B is off
     *  or the queue is lock-disabled. Powers /sessions/resume-queue*. */
    resumeQueue?: import('../monitoring/ResumeQueue.js').ResumeQueue | null;
    resumeDrainer?: import('../monitoring/ResumeQueueDrainer.js').ResumeQueueDrainer | null;
    /** AutonomousLivenessReconciler — level-triggered self-heal for an autonomous
     *  run marked active but with no live session. Null when dark/disabled.
     *  Powers GET /autonomous/liveness (spec: autonomous-liveness-reconciler.md). */
    autonomousLivenessReconciler?: import('../monitoring/AutonomousLivenessReconciler.js').AutonomousLivenessReconciler | null;
    /** Records an operator stop instruction (per-topic, or null = global) so the
     *  drainer's R2.6 operator-stop validation can see stops that post-date an
     *  entry's enqueue. Wired by the boot block alongside the queue. */
    operatorStopRecorder?: ((topicId: number | null) => void) | null;
    /** AgentWorktreeReaper — reclaims stale CLI worktrees. Null when not wired.
     *  Powers GET /worktrees/agent-reaper observability. */
    agentWorktreeReaper?: import('../monitoring/AgentWorktreeReaper.js').AgentWorktreeReaper | null;
    /** OrphanedWorkSentinel — the silent-uncommitted-death backstop. Null when not
     *  wired / dark. Powers GET /orphaned-work observability. */
    orphanedWorkSentinel?: import('../monitoring/OrphanedWorkSentinel.js').OrphanedWorkSentinel | null;
    /** McpProcessReaper — reclaims leaked MCP-server children. Null when not wired.
     *  Powers GET /processes/mcp-reaper observability. */
    mcpProcessReaper?: import('../monitoring/McpProcessReaper.js').McpProcessReaper | null;
    /** GeminiLoopRunner — multi-turn gemini loop-driver (need-gem-002). Null when not
     *  wired / dark. Powers POST + GET /gemini-loop/runs. */
    geminiLoopRunner?: import('../monitoring/GeminiLoopRunner.js').GeminiLoopRunner | null;
    /** SleepController — agent hard-sleep decision (Stage B). Powers GET /sleep. */
    sleepController?: import('../monitoring/SleepController.js').SleepController | null;
    /** AgentActivityState — shared idle signal; bumped at the inbound chokepoint. */
    agentActivityState?: import('../monitoring/AgentActivityState.js').AgentActivityState | null;
    /** SleepWakeDetector — timer-drift sleep detection with a CPU-starvation guard.
     *  Powers GET /monitoring/sleep-wake (wake + suppression telemetry). Null when
     *  not wired (older boot paths / standby) → the route 503s. */
    sleepWakeDetector?: import('../core/SleepWakeDetector.js').SleepWakeDetector | null;
    /** TaskFlow registry — durable multi-step job records (OpenClaw import).
     *  Null when not enabled. Phase 1: no business consumers; admin endpoints
     *  only. */
    taskFlowRegistry: import('../tasks/TaskFlowRegistry.js').TaskFlowRegistry | null;
    /** ThreadlineFlowBridge — resumes TaskFlow flows waiting on
     *  cross-agent-callback when a matching threadline message arrives. Null
     *  when TaskFlow is not enabled. */
    threadlineFlowBridge: import('../tasks/ThreadlineFlowBridge.js').ThreadlineFlowBridge | null;
    /** Multi-machine coordinator (cross-machine seamlessness) — null on single-machine installs. */
    coordinator: import('../core/MultiMachineCoordinator.js').MultiMachineCoordinator | null;
    /** Multi-Machine Session Pool registry (§L2) — live MachineCapacity view behind
     *  GET /pool + the Machines dashboard tab. Null/absent when not wired (ships dark). */
    machinePoolRegistry?: import('../core/MachinePoolRegistry.js').MachinePoolRegistry | null;
    /** Durable Inbound Message Queue engine getter — late-bound (the engine is
     *  constructed in the mesh block after the server). Null/absent or a null
     *  return = the queue is dark/gated; GET /pool/queue answers 503. */
    getInboundQueue?: (() => import('../core/QueueDrainLoop.js').QueueDrainLoop | null) | null;
    /** MeshRpc dispatcher (§L0) — the receive side behind POST /mesh/rpc (signed,
     *  recipient-bound, RBAC-gated m2m commands). Null/absent when not wired (dark). */
    meshRpcDispatcher?: import('../core/MeshRpc.js').MeshRpcDispatcher | null;
    /** Working-set pull coordinator (WORKING-SET-HANDOFF-SPEC §3.3) — the move
     *  trigger + reflex pipeline behind POST /coherence/fetch-working-set.
     *  Null/absent while the working-set layer is dark (rides the explicit
     *  replication gate). */
    workingSetPullCoordinator?: import('../core/WorkingSetPullCoordinator.js').WorkingSetPullCoordinator | null;
    /** Commitments-coherence replica store (COMMITMENTS-COHERENCE-SPEC §3.2) —
     *  the merged GET /commitments view folds these replicas in. Null/absent
     *  while dark (the routes return own rows only, byte-identical to before). */
    commitmentReplicaStore?: import('../core/CommitmentsSync.js').CommitmentReplicaStore | null;
    /** Preferences-pool replica store (MULTI-MACHINE-SEAMLESSNESS-SPEC §WS2.1) —
     *  the merged GET /preferences/session-context folds these replicas in (flag-
     *  gated). Null/absent while dark (the route returns own rows only, byte-
     *  identical to before). */
    preferenceReplicaStore?: import('../core/PreferencesSync.js').PreferenceReplicaStore | null;
    /** WS2.1 SEND-SIDE: the journal-backed replicated-record emitter. The correction-loop's
     *  per-request PreferencesManager (the sole recordPreference writer) attaches to this so a
     *  learned preference replicates. Null/absent while dark ⇒ strict single-machine no-op. */
    replicatedRecordEmitter?: import('../core/ReplicatedRecordEmitter.js').ReplicatedRecordEmitter | null;
    /** Replicated-store conflict ledger (multi-machine-replicated-store-foundation
     *  §7.2/§7.3) — backs GET /state/conflicts + POST /state/resolve-conflict.
     *  Null/absent while dark (the routes answer 503). */
    conflictStore?: import('../core/ConflictStore.js').ConflictStore | null;
    /** Rollback-unmerge engine (§7.4) — un-merges a (store, origin) from the union.
     *  Null/absent while dark. */
    rollbackUnmerge?: import('../core/RollbackUnmerge.js').RollbackUnmerge | null;
    /** Durable un-merged-origins registry (§7.4) — the live exclusion set the
     *  union reader consults. Null/absent while dark. */
    droppedOriginRegistry?: import('../core/RollbackUnmerge.js').DroppedOriginRegistry | null;
    /** WS2.1 — the bypass-proof union reader for the `preferences` store
     *  (multi-machine-replicated-store-foundation §7.2). GET /preferences/session-context
     *  reads the no-clobber UNION through it (own + non-dropped peer replicas; an open
     *  conflict yields BOTH variants as advisory hints, §15.1) ONLY when
     *  multiMachine.stateSync.preferences.enabled is true. Null/absent ⇒ the route
     *  keeps its legacy own-only / seamlessness-merge path, byte-identical. */
    preferencesUnionReader?: import('../core/ReplicatedStoreReader.js').ReplicatedStoreReader | null;
    /** P1.5b owner-routed mutation (§3.4): forward a mutate intent to the
     *  owning machine (verdict back, or durably queued). Null/absent = dark
     *  (replica-targeted mutations answer 409 explaining the layer is off). */
    forwardCommitmentMutate?: ((ownerMachineId: string, payload: import('../core/CommitmentMutation.js').CommitmentMutatePayload) => Promise<{
        kind: 'verdict';
        outcome: import('../core/CommitmentMutation.js').MutateOutcome;
    } | {
        kind: 'queued';
        reason: string;
    }>) | null;
    /** Per-session ownership registry (§L3) — exactly-one-owner CAS + ownerOf/
     *  placementTargetOf. Read by L4 placement + observability. Null/absent (dark). */
    sessionOwnershipRegistry?: import('../core/SessionOwnershipRegistry.js').SessionOwnershipRegistry | null;
    /** Topic placement pin store (§L4) — the holder-local hard-pin file. Backs the
     *  pinned-vs-load-placed distinction in GET /pool/placement and the deterministic
     *  POST /pool/transfer. Null/absent when the pool is not wired (dark). */
    topicPinStore?: import('../core/TopicPlacementPinStore.js').TopicPlacementPinStore | null;
    /** Cross-machine secret-sync (spec Phase 4) — backs GET /secrets/sync-status + POST /secrets/sync-now. */
    secretSync?: import('../core/SecretSync.js').SecretSyncHandle | null;
    /** This machine's mesh id (machineId). Used by placement/transfer routes to tell
     *  whether the answering machine owns the topic. Null/absent (single-machine/dark). */
    meshSelfId?: string | null;
    /** Resolve the lease-holder's base URL when this machine is NOT the holder (else
     *  null). Lets the placement/transfer routes proxy to the authoritative holder so
     *  they are answerable/callable from ANY machine. Null/absent (single-machine/dark). */
    resolveRouterUrl?: (() => string | null) | null;
    /** WS1.2 sender leg (MULTI-MACHINE-SEAMLESSNESS-SPEC): order the topic's
     *  current owner — local or remote — to DRAIN its live session for a
     *  transfer (finish the turn bounded, close, land the target's claim).
     *  Null/absent → the transfer route uses today's pin-and-release path. */
    sendDrain?: ((ownerMachineId: string, sessionKey: string, target: string, ownershipEpoch: number) => Promise<{
        ok: boolean;
        status?: string;
        reason?: string;
        noHandler?: boolean;
        runSuspended?: boolean;
    }>) | null;
    /** Every OTHER registered, non-revoked machine with a known URL — for pool-wide
     *  aggregation (GET /sessions?scope=pool). Null/absent (single-machine/dark). */
    resolvePeerUrls?: (() => Array<{
        machineId: string;
        url: string;
    }>) | null;
    /** WS4.4(f) global pool-cache unification (MULTI-MACHINE-SEAMLESSNESS-SPEC
     *  §WS4.4 clause (f)): the ONE shared per-peer poll cache that every
     *  pool-scope surface routes its per-peer fetch through, so a dashboard
     *  polling several tabs hits each peer once per interval instead of once per
     *  surface per client (and serves last-cached under CPU load-shed). Constructed
     *  in the mesh block ONLY when the dark `ws44PoolCache` flag resolves on; null
     *  ⇒ surfaces keep their existing direct per-peer fetch (byte-for-byte today's
     *  behavior). Single-machine has no peers, so it is a strict no-op there. */
    poolPollCache?: import('./PoolPollCache.js').PoolPollCache | null;
    /** Guard runtime registry (GUARD-POSTURE-ENDPOINT-SPEC §2.1) — boot-time
     *  self-registered sync getters behind GET /guards. Null/absent → the route
     *  still serves the config-derived inventory (every guard on-unverified at
     *  best), never a 503: visibility must not have an off-switch. */
    guardRegistry?: import('../monitoring/GuardRegistry.js').GuardRegistry | null;
    /** EVERY registered, non-revoked machine (with or without a known URL) —
     *  the /guards?scope=pool accounting boundary (a machine with no URL emits
     *  a named failure row, never a silent omission — spec §2.3). Null/absent
     *  (single-machine/dark). */
    listPoolMachines?: (() => Array<{
        machineId: string;
        nickname?: string;
        lastKnownUrl?: string | null;
    }>) | null;
    /** Signed, append-only rollout-stage E2E results (§Rollout) — backs GET
     *  /session-pool/e2e-results so the gate state is observable. Null/absent (dark). */
    sessionPoolE2EResultStore?: import('../core/SessionPoolE2EResultStore.js').SessionPoolE2EResultStore | null;
    /**
     * Exactly-once ingress ledger (spec §8 G3a) — non-null ONLY when
     * multiMachine.exactlyOnceIngress is enabled. When present, the inbound
     * forward path dedups via it and the outbound reply path commits. null →
     * the gate is dark (default), and the message path behaves exactly as before.
     */
    messageLedger: import('../messaging/MessageProcessingLedger.js').MessageProcessingLedger | null;
    /**
     * Per-topic "current inbound dedupeKey" — set when a forward is claimed for
     * processing, read when the reply for that topic is committed. In-memory;
     * paired with messageLedger (both null when the gate is dark).
     */
    currentInboundByTopic: Map<string, string> | null;
    /**
     * Cross-machine reply-marker propagation (spec §8 G3a). When a reply commits,
     * the outbound path broadcasts the marker to standby peers so a post-handoff
     * redelivery is deduped on the new holder. null → no propagation (paired with
     * messageLedger; both null when exactly-once is dark).
     */
    replyMarkerTransport: import('../core/ReplyMarkerTransport.js').ReplyMarkerTransport | null;
    /**
     * WS4.4 "links that survive machine boundaries" (MULTI-MACHINE-SEAMLESSNESS-SPEC
     * §WS4.4). When present, the tunnel-fronting machine can resolve the actual
     * HOLDER of a `/view/:id` (view-id ownership ≠ topic ownership) and proxy the
     * request to it carrying a short-lived, audience-bound, single-use, mesh-signed
     * USER-AUTH ASSERTION — never the raw PIN / view token (each machine's PIN
     * secret never crosses). The holder makes the authorization decision; the
     * fronting machine is a dumb relay. Null/absent on a single-machine install or
     * when the dark flag (multiMachine.seamlessness.ws44PoolLinks) is off — the
     * `/view/:id` route then behaves exactly as before (local-only).
     */
    poolLink?: {
        /** This machine's mesh fingerprint (machineId) — issuer (fronting) / holder (serving). */
        selfFingerprint: string;
        /** Fronting-side: the holder-resolution + concurrency-capped proxy. */
        proxy: import('../core/PoolViewProxy.js').PoolViewProxy;
        /** Holder-side: the single-use jti replay store. */
        jtiStore: import('../core/PoolLinkJtiStore.js').PoolLinkJtiStore;
        /** Mint a signed assertion for (holder, view, method) on the fronting side. */
        mintAssertion: (audience: {
            holderFingerprint: string;
            viewId: string;
            method: string;
        }, userAuth: import('../core/PoolLinkAssertion.js').PoolLinkAssertion['userAuth']) => import('../core/PoolLinkAssertion.js').PoolLinkAssertion;
        /** Resolve a peer machine's REGISTERED Ed25519 signing public key (PEM) — holder side. */
        resolveIssuerPublicKeyPem: (iss: string) => string | null;
        /** Ed25519 verify (canonical, signature, pem). */
        verify: (canonical: string, signature: string, pem: string) => boolean;
        /** Send a machine-authed proxied view fetch to the holder; streams the response. */
        fetchFromHolder: (holder: {
            machineId: string;
            url: string;
        }, viewId: string, method: string, assertion: import('../core/PoolLinkAssertion.js').PoolLinkAssertion) => Promise<{
            status: number;
            contentType: string | null;
            body: Buffer;
        }>;
    } | null;
    startTime: Date;
}
/**
 * Top-level config keys that may be patched via `PATCH /config`.
 * Exported as the single source of truth so the enableAction-validity test
 * (tests/unit/feature-enableaction-validity.test.ts) can assert that every
 * FeatureDefinition whose enableAction patches `/config` targets a key that is
 * actually patchable — the guard that catches the `dispatches`-class bug
 * (enableAction pointing at a non-allowlisted key) at build time.
 * Spec: docs/specs/enable-layer-coherence.md
 */
export declare const PATCHABLE_CONFIG_KEYS: ReadonlySet<string>;
export declare function createRoutes(ctx: RouteContext): Router;
export declare function formatUptime(ms: number): string;
//# sourceMappingURL=routes.d.ts.map