/**
 * HTTP admin routes for the compliance scorecard (Tier 3 of the agentic
 * eval framework).
 *
 * - `GET /admin/compliance/scorecard` — JSON contract identical to the
 *   CLI subcommand. AAuth-gated to hardware/software so anonymous public
 *   requests cannot scrape per-model data.
 * - `GET /admin/compliance/metrics` — Prometheus text format (gauge
 *   `neotoma_compliance_backfill_rate`). Gated additionally by the
 *   `NEOTOMA_COMPLIANCE_METRICS_ENABLED` env var because Prometheus
 *   scraping typically traverses internal networks rather than the
 *   AAuth-signed surface.
 *
 * The same module exports a tier guard so other compliance surfaces
 * (e.g. inspector hand-off endpoints) can reuse it.
 */
import type { Express, Request, Response } from "express";
import { getComplianceScorecard, type GroupBy } from "./scorecard.js";
declare function enforceTier(req: Request, res: Response): boolean;
declare function parseQuery(req: Request): {
    since: string | null;
    until: string | null;
    group_by: GroupBy;
    min_turns: number;
    min_backfill_rate: number;
    top_missed_steps: number;
    include_synthetic: boolean;
    user_id: string | null;
} | {
    error: string;
};
/**
 * Render Prometheus text format from a scorecard. Exposed so tests and
 * other surfaces (e.g. push gateways) can reuse the formatter.
 */
export declare function renderPrometheus(card: ReturnType<typeof getComplianceScorecard>): string;
export declare function isComplianceMetricsEnabled(env?: NodeJS.ProcessEnv): boolean;
export type UserIdResolver = (req: Request, providedUserId?: string) => Promise<string>;
/**
 * Mount compliance admin routes onto the Neotoma HTTP server. Safe to
 * call once at server boot.
 *
 * `resolveUserId` is provided by the caller (typically the helper in
 * `src/actions.ts`) so this module does not pull in the auth subsystem
 * and can be unit-tested in isolation.
 */
export declare function registerComplianceRoutes(app: Express, resolveUserId: UserIdResolver): void;
export declare const COMPLIANCE_ROUTES_INTERNALS: {
    enforceTier: typeof enforceTier;
    parseQuery: typeof parseQuery;
    isComplianceMetricsEnabled: typeof isComplianceMetricsEnabled;
    renderPrometheus: typeof renderPrometheus;
};
export {};
//# sourceMappingURL=routes.d.ts.map