/**
 * routes/owner-profile.ts
 *
 * Handlers for the `profile.*` gateway verbs over `OwnerProfileStore`
 * (../../owner-profile). Thin verb registration in the same shape as
 * routes/principals.ts: read the invocation params, call the store, answer.
 *
 * ## A write that did not happen is `ok: false`, not a thrown status
 *
 * Every write verb answers 200 with the store's own `{ ok, reason, changes,
 * disclosure }`, and `ok` is required by the output schema. That follows
 * `principals.delete` in this same directory, "an honest boolean, never a 200
 * that pretends". The alternative considered and rejected was mapping a trust
 * refusal to 403 by matching its wording, which would have made the wire status
 * depend on a sentence the trust module is free to reword. What DOES throw is
 * `refuseNonUserRequest`, because that is a statement about the CALLER rather
 * than about the document.
 *
 * ## Why every verb goes through the store
 *
 * `owner-profile/writer.ts` knows how to edit lines and nothing about trust.
 * The store runs the §7 gate, authority, then derivation against the process
 * untrusted-content ledger, then the verbatim-quote requirement, before a line
 * lands. The module barrel deliberately does not export the raw writer, and
 * nothing here reaches around the store to reach it. A gate that can be walked
 * around is not a gate.
 *
 * ## The order of the two gates on a write
 *
 * `profile.set`, `profile.append` and `profile.forget` call
 * `refuseNonUserRequest()` BEFORE anything else, including before the authority
 * check. Those are two different questions and the caller-declaration one is
 * cheaper and more specific: "you told me this was not a user request" deserves
 * its own answer rather than being folded into a trust refusal that names a
 * surface the caller never claimed. See routes/explicit-user-request.ts for why
 * an ABSENT claim proceeds and only an explicit `false` refuses.
 *
 * ## `authority` is required on every write
 *
 * It is a body parameter, not a transport-populated context field, so requiring
 * it refuses nobody who was going to succeed and closes the case where omitting
 * it granted the one tier that carries write authority. See {@link readAuthority}.
 *
 * ## Policy vs mechanism
 *
 * The owner's three switches, `profile.autonomousWrites`,
 * `profile.discloseWrites`, `profile.discloseClosedTierReads`, are applied by
 * `owner-profile-policy.ts`, which wraps the store for writes, and by the read
 * handlers below for the read receipt. The trust gate is not policy and is not
 * here: it lives in the store, and nothing in this file can turn it off.
 */
import type { GatewayMethodCatalog } from '../method-catalog.js';
import { type OwnerProfileStore } from '../../owner-profile/index.js';
import { type OwnerProfilePolicy } from './owner-profile-policy.js';
/** The read/write surface of the store these verbs need. */
export type OwnerProfileGatewayService = Pick<OwnerProfileStore, 'read' | 'get' | 'person' | 'provenance' | 'status' | 'set' | 'append' | 'forget' | 'undo'>;
/**
 * Attach the nine handlers.
 *
 * `policy` defaults to permissive so a caller that has no config to read from,
 * a test, a narrow embed, behaves exactly as the schema defaults describe.
 * The daemon passes live predicates, so all three switches take effect on the
 * next call rather than on the next restart.
 */
export declare function registerOwnerProfileGatewayMethods(catalog: GatewayMethodCatalog, service: OwnerProfileGatewayService, policy?: OwnerProfilePolicy): void;
//# sourceMappingURL=owner-profile.d.ts.map