/**
 * Product admission of the serving daemon (issue #165 D5). One canonical
 * coordinator snapshot drives the socket RPC gate, the control-API route
 * gate, and the handshake's `servingMode` disclosure — transport/protocol
 * success stays separate from product readiness. `recovery_only` keeps the
 * recovery plane (health, handshake, recovery routes, operator stop) online
 * while every normal product surface refuses with one typed error.
 */
export type DaemonServingMode = "normal" | "recovery_only";
/** Snapshot reader wired into servers; absent means an always-normal embedder. */
export type DaemonServingModeSnapshot = () => DaemonServingMode;
export declare function servingModeOf(snapshot: DaemonServingModeSnapshot | undefined): DaemonServingMode;
/** The single typed refusal every closed product surface returns. */
export declare function recoveryOnlyRefusal(surface: string): Error & {
    code: "daemon_recovery_only";
    status: 503;
    retryable: true;
};
/** Constant-time token comparison shared by the socket and HTTP planes. */
export declare function daemonTokenMatches(candidate: string, expected: string): boolean;
//# sourceMappingURL=serving-admission.d.ts.map