/**
 * routes/push-composition.ts
 *
 * Builds the daemon's one `PushService`: VAPID key custody, the subscription
 * store with its housekeeping wired, and the live config reads the delivery and
 * escalation paths make per event.
 *
 * Split out of register-gateway-verb-groups.ts so the composition root stays a
 * registration index rather than also being the place push policy is assembled.
 *
 * Every config read here is LIVE, evaluated per event or per sweep, never
 * captured at construction, so changing `push.*` or `notifications.push*`
 * takes effect without restarting the daemon.
 */
import { PushService, PushSubscriptionStore, type VapidSecretStore } from '../../push/index.js';
import type { ConfigManager } from '../../config/manager.js';
import type { DisposalRegistry } from '../../runtime/disposal.js';
/** The slice of the gateway dependency bag push composition needs. */
export interface PushCompositionDeps {
    /** SecretsManager (get/set), VAPID keypair custody lives here, never in config. */
    readonly secretsManager: VapidSecretStore;
    /** Home-scoped path service; the subscription store file resolves under it. */
    readonly shellPaths: {
        resolveUserPath(...segments: string[]): string;
    };
    /** Surface root the subscription store resolves under; required, never defaulted (control-plane-store-paths.ts). */
    readonly surfaceRoot: string;
    readonly configManager?: Pick<ConfigManager, 'get'> | undefined;
    /** Explicit VAPID `sub` override; absent ⇒ the `push.vapidSubject` config key. */
    readonly vapidSubject?: string | undefined;
    /**
     * Where the subscription store's periodic sweep registers its stop. Present
     * when composed from a runtime graph that can be torn down; absent in narrow
     * compositions, whose caller owns the store directly.
     */
    readonly disposal?: DisposalRegistry | undefined;
}
/**
 * The VAPID JWT `sub`, the contact a push service uses to report a delivery
 * problem. Explicit dep first (embedders), then the `push.vapidSubject` config
 * key, then the documented localhost fallback inside VapidManager. A configured
 * value that is not a mailto:/https: contact is refused by the config gate; if
 * one reaches here anyway (a hand-edited config file), it is reported and
 * dropped rather than signed into every JWT or crashing construction.
 */
export declare function resolveVapidSubject(deps: PushCompositionDeps): string | undefined;
/**
 * The subscription store with housekeeping running: reaped on recovery before
 * any push verb is served, then swept on the configured interval, a daemon
 * that only swept at boot would never sweep at all.
 *
 * `warnAbovePerPrincipal` is a WARNING line, never a cap: nothing that still
 * works is ever removed to make room (see push/subscription-housekeeping.ts).
 */
export declare function createPushSubscriptionStore(deps: PushCompositionDeps): PushSubscriptionStore;
/** The daemon's one PushService, with every policy read wired live to config. */
export declare function createPushService(deps: PushCompositionDeps): PushService;
//# sourceMappingURL=push-composition.d.ts.map