/**
 * @fileoverview Codeman web server — central hub coordinating all subsystems.
 *
 * Fastify-based web server providing:
 * - ~111 REST API routes (delegated to `src/web/routes/` domain modules)
 * - SSE streaming at `/api/events` with backpressure handling
 * - Static file serving for the web UI (1-year cache in production)
 * - 60fps terminal streaming via batched PTY output (16-50ms adaptive)
 *
 * Coordinates: SessionManager, RespawnController, SubagentWatcher, TeamWatcher,
 * TranscriptWatcher, ImageWatcher, TunnelManager, PushSubscriptionStore,
 * PlanOrchestrator, RunSummaryTracker, FileStreamManager.
 *
 * Key exports:
 * - `WebServer` class — implements all port interfaces, extends EventEmitter
 * - `startWebServer(options)` — factory function to create and start the server
 *
 * Implements port interfaces: `SessionPort`, `EventPort`, `ConfigPort`,
 * `RespawnPort`, `MuxPort`, `FilePort`, `ScheduledPort`, `PushPort`, `TeamPort`
 * (see `src/web/ports/` for definitions)
 *
 * @dependencies All major subsystems (session, respawn-controller, subagent-watcher,
 *   team-watcher, tunnel-manager, state-store, etc.)
 * @consumedby src/index.ts (entry point), src/cli.ts
 * @emits SSE events via broadcast() — see sse-events.ts for full registry
 *
 * @module web/server
 */
import { EventEmitter } from 'node:events';
export declare class WebServer extends EventEmitter {
    private app;
    private sessions;
    private respawnControllers;
    private respawnTimers;
    private runSummaryTrackers;
    private transcriptWatchers;
    private sessionListenerRefs;
    private scheduledRuns;
    private sse;
    private store;
    private port;
    private host;
    private https;
    private testMode;
    private mux;
    private cleanup;
    private cachedLightState;
    private static readonly LIGHT_STATE_CACHE_TTL_MS;
    private cachedSessionsList;
    private lastRecordedTokens;
    private readonly serverStartTime;
    private pendingRespawnStarts;
    private activePlanOrchestrators;
    private persistDeb;
    private subagentWatcherHandlers;
    private imageWatcherHandlers;
    private tunnelManager;
    private authSessions;
    private authFailures;
    private qrAuthFailures;
    private hookSecretFailures;
    private pushStore;
    private teamWatcher;
    private _orchestratorLoop;
    private readonly titleHostname;
    private readonly windowTitle;
    private readonly indexHtmlTemplate;
    private readonly allowUnauthenticatedNetwork;
    private _pasteImageGcStop;
    private _eventLoopMonitor;
    private teamWatcherHandlers;
    constructor(port?: number, https?: boolean, testMode?: boolean, host?: string, titleHostname?: string, allowUnauthenticatedNetwork?: boolean);
    /**
     * Set up event listeners for subagent watcher.
     * Broadcasts real-time subagent activity to SSE clients.
     *
     * The SubagentWatcher now extracts descriptions directly from the parent session's
     * transcript, which contains the exact Task tool call with the description parameter.
     * This is more reliable than the previous timing-based correlation approach.
     */
    private setupSubagentWatcherListeners;
    /**
     * Clean up subagent watcher listeners to prevent memory leaks.
     */
    private cleanupSubagentWatcherListeners;
    /**
     * Set up event listeners for image watcher.
     * Broadcasts image detection events to SSE clients for auto-popup.
     */
    private setupImageWatcherListeners;
    /**
     * Clean up image watcher listeners to prevent memory leaks.
     */
    private cleanupImageWatcherListeners;
    /**
     * Set up event listeners for team watcher.
     * Broadcasts team activity events to SSE clients.
     */
    private setupTeamWatcherListeners;
    /**
     * Clean up team watcher listeners to prevent memory leaks.
     */
    private cleanupTeamWatcherListeners;
    /**
     * Build a route context object satisfying all 5 port interfaces.
     * Single object with zero runtime cost — ISP enforced at the type level.
     */
    private createRouteContext;
    /**
     * Current Host/Origin allowlist policy. Read per request so a tunnel started at
     * runtime (PUT /api/settings) is reflected without a restart.
     */
    private getHostPolicy;
    private setupRoutes;
    /**
     * Start a transcript watcher for a session.
     * Creates a new watcher or updates an existing one with the new transcript path.
     */
    private startTranscriptWatcher;
    /**
     * Stop the transcript watcher for a session.
     */
    private stopTranscriptWatcher;
    /** Debounced wrapper — coalesces rapid persistSessionState calls per session */
    private persistSessionState;
    /** Persists full session state including respawn config to state.json */
    private _persistSessionStateNow;
    private saveRespawnConfig;
    private cleaningUp;
    private cleanupSession;
    private _doCleanupSession;
    private renderIndexHtml;
    /** mtime memo for asset cache-busting (keyed by absolute path). A full index
     *  render does one stat per script/link tag (~25-30); without this each `/`,
     *  `/index.html` and `/session/:id` hit would re-stat them all. A 1s TTL keeps
     *  a burst of renders cheap while still picking up an edited/redeployed file
     *  within a second (no server restart needed). */
    private _assetVersionMemo;
    private assetVersion;
    /** Cache-busting query for the gesture bundle: its mtime (memoized, see
     *  assetVersion). The bundle is served from /gesture/ with a 1-year cache, so
     *  without a version that changes on redeploy the browser would keep running a
     *  stale bundle forever. Empty string if the file is missing. */
    private gestureBundleVersion;
    /** Append ?v=<mtime> to every same-origin .js/.css reference in the page so a
     *  normal reload always serves the latest. Codeman's static assets are sent
     *  with `Cache-Control: max-age=1y, immutable` and the script/link tags carry
     *  no version, so without this an edited module (panels-ui.js, styles.css, …)
     *  stays cached until a manual hard refresh. mtime is memoized (1s TTL) so a
     *  changed file is picked up with no server restart. External URLs (have a
     *  `:` scheme), already-versioned refs (have a `?`), and refs with no matching
     *  file on disk are left untouched. */
    private cacheBustAssets;
    private setupSessionListeners;
    /** Build the deps object for session listener wiring. */
    private buildSessionListenerDeps;
    /**
     * Register a terminal-requested external file as a live attachment and
     * broadcast it. Triggered by the session's `attachmentRequested` event
     * (codeman://attach magic links). Because terminal output is
     * attacker-influenceable (a prompt-injected session can print an arbitrary
     * `codeman://attach?path=` link), the scanned path is FORCE-confined to the
     * session workspace — passive magic links can't expose arbitrary host files.
     * Deliberate cross-workspace attachment goes through the explicit,
     * Origin-guarded `POST /attachments` route (and `codeman attach`, which POSTs
     * directly inside a managed session). Registration also enforces the COD-53
     * blocklist as defense-in-depth.
     */
    private registerAttachment;
    private setupRespawnListeners;
    private setupTimedRespawn;
    private restoreRespawnController;
    private buildRespawnWiringDeps;
    private getDefaultClaudeMdPath;
    private _settingsCache;
    private readSettings;
    private getGlobalNiceConfig;
    private getClaudeModeConfig;
    private getModelConfig;
    private startScheduledRun;
    private runScheduledLoop;
    private stopScheduledRun;
    /**
     * Get session state with respawn controller info included.
     * Use this for session:updated broadcasts to preserve respawn state on the frontend.
     */
    private getSessionStateWithRespawn;
    /**
     * Get lightweight session state for SSE init - excludes full terminal buffers
     * to prevent browser freezes on SSE reconnect. Full buffers are fetched
     * on-demand when switching tabs via /api/sessions/:id/buffer
     */
    private getLightSessionsState;
    private cleanupScheduledRuns;
    /**
     * Cleans up stale sessions from state file that don't have active sessions.
     * Called on startup and can be called via API endpoint.
     * @returns Number of sessions cleaned up
     */
    private cleanupStaleSessions;
    /**
     * Get lightweight state for SSE init - excludes full terminal buffers
     * to prevent browser freezes. Terminal buffers are fetched on-demand.
     */
    private getLightState;
    private broadcast;
    private batchTerminalData;
    private batchTaskUpdate;
    private broadcastSessionStateDebounced;
    /** Map SSE event names to push notification payloads */
    private static readonly PUSH_EVENT_MAP;
    /**
     * Send push notifications for a given event to all subscribed devices.
     * Only events in PUSH_EVENT_MAP trigger push. Per-subscription preferences are checked.
     * Expired subscriptions (410/404) are auto-removed.
     */
    private sendPushNotifications;
    private cleanupDeadSSEClients;
    /**
     * Records token usage for long-running sessions periodically.
     * Called every 5 minutes to capture usage in daily stats without waiting for session deletion.
     */
    private recordPeriodicTokenUsage;
    start(): Promise<void>;
    /**
     * Check if subagent tracking is enabled in settings (default: true)
     */
    private isSubagentTrackingEnabled;
    /**
     * Check if image watcher is enabled in settings (default: false)
     */
    private isImageWatcherEnabled;
    /**
     * Check if Cloudflare tunnel is enabled in settings (default: false)
     */
    private isTunnelEnabled;
    private restoreMuxSessions;
    private initOrchestratorLoop;
    stop(): Promise<void>;
}
export declare function startWebServer(port?: number, https?: boolean, testMode?: boolean, host?: string, titleHostname?: string, allowUnauthenticatedNetwork?: boolean): Promise<WebServer>;
//# sourceMappingURL=server.d.ts.map