export declare const BOOTSTRAP_TOKEN_FILE: string;
/**
 * Called once at process startup. If no admin is configured (env empty,
 * no runtime additions), regenerates a fresh token file and logs the
 * onboarding instruction. Idempotent on already-admin'd boxes — does
 * nothing.
 *
 * Returns the token on first-run boxes (so callers can echo it to
 * stdout in addition to the structured log), null on already-configured
 * boxes.
 */
export declare function ensureBootstrapTokenIfNeeded(): string | null;
/**
 * v1.2.2 — generate an admin INVITE token unconditionally (even when an
 * admin already exists). Reuses the same bootstrap-token file + the same
 * `/setup admin <token>` IM flow. Overwrites any existing unconsumed
 * token so only the latest invite is valid at any time.
 *
 * Intended for an existing admin to onboard additional admins without
 * SSH'ing into the server to look up the autogen bootstrap token.
 * Triggered by `agim admin invite` CLI / the entry-menu option.
 */
export declare function generateAdminInviteToken(): {
    token: string;
    file: string;
};
/**
 * Verify a candidate token + promote the caller to admin on success.
 * Returns the outcome so the slash-command handler can craft the right
 * reply. On success, the token file is unlinked (single-use).
 */
export declare function consumeBootstrapToken(candidate: string, platform: string, userId: string): Promise<{
    ok: true;
    alreadyAdmin: false;
} | {
    ok: true;
    alreadyAdmin: true;
} | {
    ok: false;
    reason: 'no_token_file' | 'mismatch' | 'missing_user_id';
}>;
//# sourceMappingURL=admin-bootstrap.d.ts.map