/**
 * Post-Update Migrator — the "intelligence download" layer.
 *
 * When an agent installs a new version of instar, updating the npm
 * package only changes the server code. But the agent's local awareness
 * lives in project files: CLAUDE.md, hooks, scripts.
 *
 * This migrator bridges that gap. After every successful update, it:
 *   1. Re-installs hooks with the latest templates (behavioral upgrades)
 *   2. Patches CLAUDE.md with any new sections (awareness upgrades)
 *   3. Installs any new scripts (capability upgrades)
 *   4. Deploys missing built-in skills (exec:skill job support)
 *   5. Returns a human-readable migration report
 *
 * Design principles:
 *   - Additive only: never remove or modify existing user customizations
 *   - Hooks are overwritten (they're generated infrastructure, not user-edited)
 *   - CLAUDE.md sections are appended only if missing (check by heading)
 *   - Scripts are installed only if missing (never overwrite user modifications)
 */
import { type MigratorStep, type RunPendingStepsResult } from './MigratorStepEngine.js';
/**
 * The "Playwright Profile Registry" CLAUDE.md awareness section. SHARED by
 * `generateClaudeMd` (new installs) and `migrateClaudeMd` (existing agents) so the
 * two can never drift (Agent Awareness + Migration Parity). Uses the `${port}`
 * template var — NEVER a hardcoded port. Content-sniff marker: 'Playwright Profile
 * Registry'. Spec: docs/specs/playwright-profile-registry.md.
 */
export declare function PLAYWRIGHT_PROFILE_REGISTRY_CLAUDEMD_SECTION(port: number): string;
export interface MigrationResult {
    /** What was upgraded */
    upgraded: string[];
    /** What was already up to date */
    skipped: string[];
    /** Any errors that occurred (non-fatal) */
    errors: string[];
}
export interface MigratorConfig {
    projectDir: string;
    stateDir: string;
    port: number;
    hasTelegram: boolean;
    projectName: string;
}
/**
 * WS4.4 dev-gate config migration (MULTI-MACHINE-SEAMLESSNESS-SPEC §WS4.4).
 * SECURITY-CRITICAL feature, DEV-GATED dark: the runtime resolves the flag via
 * `resolveDevAgentGate()` (`explicit ?? !!developmentAgent`), so the config must
 * OMIT it — present on a dev agent ⇒ live, absent on the fleet ⇒ dark.
 *
 * This migration enforces that invariant existence-checked + idempotently. It
 * STRIPS a default-shaped literal `multiMachine.seamlessness.ws44PoolLinks=false`
 * (the PR #1001 anti-pattern — an injected `false` force-darks even dev agents)
 * so the dev-gate resolves live, exactly like the cartographer-dev-gate fix.
 *
 * Pure + mutating-in-place so it is unit-testable; returns true iff it changed
 * `config`. Rules:
 *   - key absent           → no-op (false). The gate already decides correctly.
 *   - key === false        → STRIP it (true). It was a default-shaped force-dark.
 *   - key === true         → leave it (false). An operator's explicit fleet-flip wins.
 * A stripped seamlessness block left empty is removed so the file stays clean.
 */
export declare function migrateConfigWs44PoolLinks(config: Record<string, unknown>): boolean;
/**
 * WS4.4(f) global pool-cache unification (CMT-1416). Same omitted-gate invariant
 * as ws44PoolLinks: `ws44PoolCache` is a dev-gated dark flag resolved via
 * resolveDevAgentGate(), so the config must OMIT it (present on a dev agent ⇒
 * live, absent on the fleet ⇒ dark). An existing agent that somehow carries a
 * default-shaped literal `false` would force-dark even a dev agent — strip it so
 * the gate resolves correctly. An explicit `true` (operator fleet-flip) is
 * preserved. Idempotent + existence-checked.
 */
export declare function migrateConfigWs44PoolCache(config: Record<string, unknown>): boolean;
/**
 * Live credential re-pointing was re-gated from DARK_GATE_EXCLUSIONS (off+dry-run for
 * everyone) to the developmentAgent gate (live-on-dev in dry-run, dark fleet) per the
 * 2026-06-13 operator directive. Existing agents that ran the old ConfigDefaults carry an
 * explicit `subscriptionPool.credentialRepointing.enabled: false`, which (being explicit)
 * would keep resolveDevAgentGate DARK even on a dev agent. Strip that default-shaped
 * `false` so the gate resolves (live on dev, dark on fleet) — mirroring the ws44PoolLinks
 * strip. An explicit `true` is preserved (an operator who deliberately turned it on). The
 * separate `dryRun`/`manualLeversEnabled` fields are left untouched (dryRun stays the
 * write-safety canary). Idempotent.
 */
export declare function migrateConfigCredentialRepointingDevGate(config: Record<string, unknown>): boolean;
/**
 * The Playwright profile registry is a developmentAgent dark-feature: `enabled` is
 * OMITTED from ConfigDefaults so resolveDevAgentGate resolves it (live on dev, dark
 * on the fleet); the destructive `activate` write is gated by the SEPARATE
 * `dryRun:true`. An existing agent that somehow carries a default-shaped literal
 * `playwrightRegistry.enabled: false` would force-dark even a dev agent (the #1001
 * mechanism) — strip a default-shaped `false` so the gate resolves, mirroring the
 * credentialRepointing strip. An explicit `true` (operator fleet-flip) is preserved;
 * the separate `dryRun` field is left untouched (it stays the write-safety canary).
 * Idempotent + existence-checked.
 */
export declare function migrateConfigPlaywrightRegistryDevGate(config: Record<string, unknown>): boolean;
/**
 * "Self-Unblock Before Escalating" (docs/specs/self-unblock-before-escalating.md):
 * the two nested blockerLedger sub-features — selfUnblockChecklist + durableVaultSession
 * — are dev-gated dark features resolved via resolveDevAgentGate, so the config must
 * OMIT their `enabled` (present-on-dev ⇒ live, absent-on-fleet ⇒ dark). An existing
 * agent that somehow carries a default-shaped literal `enabled: false` on either nested
 * block would force-dark even a dev agent (the #1001 mechanism) — strip a default-shaped
 * `false` so the gate resolves (live on dev, dark on fleet), mirroring the
 * credentialRepointing strip. An explicit `true` (operator fleet-flip) is preserved; the
 * separate ttlMs/idleMs tunables are left untouched. applyDefaults backfills the nested
 * empty objects. Idempotent + existence-checked.
 */
export declare function migrateConfigSelfUnblockChecklistDevGate(config: Record<string, unknown>): boolean;
/**
 * The 7 multiMachine.stateSync.* memory stores (preferences, relationships, learnings,
 * knowledge, evolutionActions, userRegistry, topicOperator) were re-gated from
 * DARK_GATE_EXCLUSIONS (off for everyone) to the developmentAgent gate (live-on-dev,
 * dark fleet) per the 2026-06-13 operator directive (topic 13481: "NOTHING should ship
 * dark on development agents"). Existing agents that ran the old ConfigDefaults carry an
 * explicit `enabled: false` per store, which (being explicit) would keep
 * resolveDevAgentGate DARK even on a dev agent. Strip that default-shaped `false` so the
 * gate resolves (live on dev, dark on fleet) — mirroring the credentialRepointing strip.
 *
 * UNLIKE credentialRepointing (which keeps `dryRun:true` as the write-safety canary for a
 * destructive keychain write), these stores have NO destructive write and the operator's
 * decision is GENUINELY LIVE — so the new ConfigDefaults set `dryRun:false`. Existing
 * agents carry the old default-shaped `dryRun:true`; applyDefaults (add-missing-only)
 * would NOT overwrite it, leaving the agent on a stale dryRun:true. To land the operator's
 * not-dry-run intent, the OLD-DEFAULT SIGNATURE is treated as one unit: a store whose
 * block is exactly `{ enabled:false, dryRun:true }` (the ConfigDefaults-backfilled shape,
 * never an operator's hand edit) has BOTH stripped, so applyDefaults backfills the new
 * `{ dryRun:false }`. A store with any divergence (explicit `enabled:true`, a different
 * dryRun, extra keys) is treated as operator-touched and left ENTIRELY alone — reach is
 * not authority. Idempotent (a second run finds nothing default-shaped to strip).
 */
export declare function migrateConfigStateSyncStoresDevGate(config: Record<string, unknown>): boolean;
/**
 * Strip default-shaped literal `false` for the 5 seamlessness coherence flags so
 * the developmentAgent gate resolves them (live on dev, dark on fleet) — exactly the
 * ws44PoolLinks / ws44PoolCache invariant, applied to ws3OneVoice / ws13Reconcile /
 * ws41DurableAck / ws43RoleGuard / ws43JournalLease (operator directive 2026-06-13,
 * topic 13481). An existing agent that ran the old ConfigDefaults carries an explicit
 * `false` per flag, which (being explicit) would keep resolveDevAgentGate DARK even on
 * a dev agent. Rules per flag:
 *   - absent          → no-op. The gate already decides correctly.
 *   - === false       → STRIP it. It was a default-shaped force-dark.
 *   - === true        → leave it. An operator's explicit fleet-flip wins.
 *
 * SPECIAL CASE ws43JournalLeaseDryRun: the OLD default carried the PAIR
 * `{ ws43JournalLease:false, ws43JournalLeaseDryRun:true }`. The new ConfigDefaults
 * OMIT BOTH so the consumer computes dryRun COHERENTLY with the gate (dev→false/live,
 * fleet→true/dry-run). So when ws43JournalLease is a default-shaped `false` AND
 * ws43JournalLeaseDryRun is a default-shaped `true`, strip the dryRun key too (so the
 * consumer's coherent default applies). An operator-set ws43JournalLeaseDryRun (any
 * other value, or present without the paired false) is left untouched — reach is not
 * authority. A stripped seamlessness block left empty is removed. Idempotent.
 */
export declare function migrateConfigSeamlessnessDevGate(config: Record<string, unknown>): boolean;
/**
 * mergerunner-auto-arm-handoff (Migration Parity §k). Add the FIVE new
 * greenPrAutoMerge defaults existence-checked. Only acts when the
 * `monitoring.greenPrAutoMerge` object ALREADY exists (a fleet agent without the
 * feature is never touched — this is config-defaults, not feature-enablement).
 * Each field is added ONLY when MISSING, so an operator's explicit override is
 * never clobbered and the migration is idempotent (a second run finds them all
 * present). The five fields are the four DEFAULTS additions + unconfirmedArmCeiling.
 */
export declare function migrateConfigGreenPrAutoArmDefaults(config: Record<string, unknown>): boolean;
/**
 * WS5.2 R12.iii — add the offline-revocation reconnect-deadline default to an existing
 * `multiMachine.accountFollowMe` block. Existence-checked + idempotent: only ADDS
 * `revocationReconnectDeadlineMs` when MISSING (never clobbers an operator override), and only when
 * the accountFollowMe block already exists (a pre-spec agent without it is untouched — the field is
 * inert without the feature). Returns true iff it patched. Default 6h (hours, not days — a live
 * credential, gap 9 lean).
 */
export declare function migrateConfigAccountFollowMeRevocationDeadline(config: Record<string, unknown>): boolean;
export declare class PostUpdateMigrator {
    private config;
    /**
     * F-7 atomic-step engine. Lazily constructed on first access via
     * `getStepEngine()` so existing callers that never touch atomic steps
     * pay zero cost. See `src/core/MigratorStepEngine.ts` for the primitive
     * docs; see `docs/specs/SELF-HEALING-REMEDIATOR-V2-SPEC.md` §A35/§A50
     * for the spec.
     */
    private stepEngine;
    constructor(config: MigratorConfig);
    /**
     * Resolve the set of frameworks this install actively uses, read from
     * the persisted `.instar/config.json` `enabledFrameworks` field.
     *
     * Default (unset / empty / unreadable): `['claude-code']` — the
     * historical behavior, so existing and dual-framework installs are
     * unaffected. A Codex-only install sets `enabledFrameworks:
     * ['codex-cli']`, which makes framework-specific migration steps that
     * scaffold `.claude/`-only artifacts skip cleanly instead of writing
     * files that runtime will never read.
     *
     * Single source of truth for the migrator's framework gating — both
     * the parity-renderings backfill and the legacy `.claude/`-specific
     * steps consult this.
     */
    private getEnabledFrameworks;
    /**
     * F-7 atomic-step primitive: register a step that will run once on
     * the release boundary where `step.version <= toVersion`. Idempotent
     * across runs — the engine records every step's outcome in
     * `<stateDir>/migrator-steps-completed.json` keyed by
     * `<version>:<step-name>`.
     *
     * Steps are atomic and self-contained: a failure in one step does not
     * roll back prior steps and does not block subsequent steps.
     *
     * See `docs/specs/SELF-HEALING-REMEDIATOR-V2-SPEC.md` §A35 + §A50.
     */
    registerStep(step: MigratorStep): void;
    /**
     * F-7 atomic-step primitive: execute every pending step. Pending =
     * step.version <= toVersion AND no ledger entry recorded yet.
     *
     * Steps run in registration order. Failures are recorded (never
     * thrown) and do not stop subsequent steps.
     */
    runPendingSteps(fromVersion: string, toVersion: string): Promise<RunPendingStepsResult>;
    private getStepEngine;
    private templateCandidates;
    /**
     * Read a built-in template from the compiled layout when templates have
     * been copied to dist, or from the packaged source-template layout used by
     * current npm publishes.
     */
    private loadTemplate;
    /**
     * Run all post-update migrations. Safe to call multiple times —
     * each migration is idempotent.
     */
    migrate(): MigrationResult;
    /**
     * Backfill the AutonomousProgressHeartbeat config defaults into an EXISTING
     * agent's config.json (Migration Parity item 2 + the spec's §Migration parity).
     * Writes ONLY `dryRun` / `silenceThresholdMinutes` / `tickIntervalMs` /
     * `maxHeartbeatsPerRun` / `recentOutputChangeWindowMs` with existence checks —
     * it must NEVER write `enabled` (that would pin existing dev agents DARK and
     * defeat the resolveDevAgentGate dev-gate). Idempotent (marker + per-key
     * existence-checked; operator overrides preserved). Pairs with the CLAUDE.md
     * section added in migrateClaudeMd and the framework-shadow marker carried by
     * migrateFrameworkShadowCapabilities (the new CLAUDE.md heading is copied into
     * any framework-shadow CLAUDE.md automatically by that pass).
     */
    private migrateAutonomousHeartbeatDefaults;
    private migrateConformanceGateAutoInvoke;
    private migrateCommitmentOwnerBackfill;
    private migratePlaywrightProfilesSeed;
    private migrateMultiMachinePostureReviewDimension;
    private migrateCartographerDevGate;
    private migrateDevGateTeethStrip;
    private migrateHonestProgressMessagingDefaults;
    /**
     * Seed the interactive first-launch onboarding flags into every EXISTING
     * claude-code subscription-pool config home (2026-06-09 incident, topic
     * 20905). Pool homes are enrolled via headless `claude auth login`, which
     * stores OAuth tokens but never sets `hasCompletedOnboarding` /
     * `bypassPermissionsModeAccepted` / `hasTrustDialogAccepted` — so the first
     * interactive session pinned or quota-swapped onto such a home wedged on the
     * first-launch onboarding screens (~8 live sessions at once). New
     * enrollments are seeded by EnrollmentWizard.complete() and every pinned/
     * swapped launch re-ensures defensively; this migration is the one-time
     * sweep that makes homes enrolled BEFORE the fix safe.
     *
     * Idempotent (ensureInteractiveReady only writes missing flags) and
     * fail-safe (the util never throws; per-home failures are reported, never
     * abort the sweep). Only flags are ever written — oauthAccount/tokens are
     * untouched by construction, and an unparseable `.claude.json` is refused,
     * not rewritten. `requireExistingHome` keeps a stale registry entry from
     * littering $HOME with empty credential-less homes.
     */
    private migrateSubscriptionPoolInteractiveReady;
    /**
     * Regenerate the boot wrapper when it predates the ABI-aware node
     * self-heal (recurring-SQLite-bane fix).
     *
     * The `.js → .cjs` migration above only regenerates the wrapper when the
     * plist still references the old `.js` name — agents already on `.cjs`
     * (the majority) are skipped, so they'd never receive the new
     * selfHealNodeSymlink logic that detects "node runs but can't load
     * better-sqlite3" and re-points to an ABI-compatible node. This migration
     * closes that gap: if the on-disk `instar-boot.cjs` lacks the ABI-check
     * marker, regenerate it via installBootWrapper.
     *
     * Idempotent: once the marker is present, it skips.
     */
    private migrateBootWrapperAbiCheck;
    private migrateStaleLifelineSignal;
    /**
     * Threadline Phase 1 keystone (THREADLINE-CONVERSATION-KEYSTONE-SPEC, Migration
     * parity): fold the legacy thread-resume-map.json + context-thread-map.json
     * into the unified conversations.json so in-flight conversations survive the
     * update with their turn/binding context. Idempotent (skips a threadId already
     * present in conversations.json — never clobbers runtime-written rows),
     * atomic (tmp + rename), and field-preserving (sessionUuid, agentIdentity,
     * pinned, lifecycle incl. failed/archived, cross-machine fields). Reconciliation
     * rule: the resume entry is authoritative for session binding; the contextId
     * index is attached from the context map (distinct fields, no conflict).
     */
    private migrateThreadlineConversationStore;
    /**
     * Threadline identity-discovery unification (THREADLINE-IDENTITY-DISCOVERY-
     * UNIFICATION-SPEC, Migration parity): existing agents may carry an
     * agent-info.json whose `publicKey` is the orphan identity-keys.json hex key
     * (or no `fingerprint` at all) while the relay routes by the canonical
     * identity.json fingerprint — so peers who discover them obtain a dead
     * address. The fixed announcePresence rewrites agent-info.json on every boot,
     * and the update path restarts the server, so the common case self-heals.
     * This is the belt-and-suspenders for the narrow window where the package
     * updates but the server has not yet restarted before a peer tries to
     * discover the agent.
     *
     * Resolves the routing identity via the SAME read-only API the relay client
     * uses (IdentityManager.get()). If it yields an identity whose fingerprint is
     * absent from / differs from agent-info.json, rewrites agent-info.json with
     * the consistent { fingerprint, publicKey(hex) } pair. No-op (never
     * fabricate) when get() is null (no identity, or locked-encrypted) or when
     * agent-info.json is already aligned. Atomic write; idempotent across runs;
     * last-writer-wins with a concurrent boot announce is safe (same value).
     */
    private migrateThreadlineAgentInfoIdentity;
    /**
     * 2026-06-05 worktree-misplaced flood cleanup (Bounded Notification
     * Surface). The pre-fix AgentWorktreeDetector emitted one attention item
     * PER worktree with ids `worktree-misplaced:<sha256>`; a transiently-wrong
     * safe-root read mass-created 110 false-positive OPEN items on flooded
     * agents. The fixed detector emits a single `worktree-misplaced-summary:*`
     * item, so the old per-path items are permanently stale — purge them.
     * Idempotent: a store with no old-format ids is left untouched.
     */
    private migrateWorktreeMisplacedFloodItems;
    private migrateBootWrapperToCjs;
    private migrateConversationalCatalogPlaybookManifest;
    /**
     * OS resource hygiene (Responsible Resource Usage standard): ensure a
     * `.metadata_never_index` marker at the agent's `.worktrees/` container so
     * macOS Spotlight/mediaanalysisd stop re-indexing every worktree beneath it.
     * Existing agents accumulated dozens of worktrees before the create-path drop
     * existed; this backfills the marker so they get the relief on update. The
     * marker is honored recursively, harmless on non-macOS, and idempotent.
     */
    private migrateWorktreeSpotlightExclusion;
    /**
     * OS resource hygiene (Responsible Resource Usage standard): exclude the agent's
     * node_modules trees from macOS Spotlight. The worktree exclusion above covers
     * `.worktrees/`, but the bigger churning set was never excluded — each agent home
     * carries a full `node_modules/` (~1.3GB / ~25k files measured) AND a
     * `.instar/shadow-install/node_modules/` (~600MB), re-indexed by Spotlight /
     * mediaanalysisd on every `npm ci` and every shadow-install update. Across a
     * ~10-agent fleet that is ~20GB of un-excluded node_modules — a top OS-level CPU
     * consumer (measured: Metadata.framework ~62% CPU). node_modules never need
     * Spotlight indexing, so the marker is unambiguously safe; it is honored
     * recursively, harmless on non-macOS, and idempotent. Reuses the generic
     * marker-dropper. (`ensureWorktreeSpotlightExclusion` is dir-agnostic.)
     */
    private migrateNodeModulesSpotlightExclusion;
    /**
     * OS resource hygiene (Responsible Resource Usage standard): exclude this
     * agent's Claude Code transcript directory (`~/.claude/projects/<encoded-home>`)
     * from macOS Spotlight. The node_modules + worktree exclusions above cover the
     * static/throwaway trees, but the BIGGEST churning set was never excluded — the
     * JSONL session transcripts grow on every assistant/user turn and an active home
     * accumulates many GB (measured ~18GB on a busy fleet box), which Spotlight
     * (mds_stores) re-indexes on every change, a top OS-level CPU consumer. instar
     * already READS these transcripts (TokenLedger), so excluding them from indexing
     * is the matching hygiene; nothing usefully Spotlight-searches a Claude JSONL.
     * Honored recursively, harmless on non-macOS, idempotent, and a graceful no-op
     * when the transcript dir doesn't exist yet (a brand-new agent with no sessions).
     */
    private migrateClaudeTranscriptSpotlightExclusion;
    /**
     * OS resource hygiene (Responsible Resource Usage standard): exclude the agent's
     * OWN runtime data dir (`<stateDir>` = `<agentHome>/.instar`) from macOS Spotlight.
     * The worktree (#588), node_modules (#606), and Claude-transcript (#903) exclusions
     * cover everything EXCEPT the agent's own churning data: `telegram-images/` (every
     * user photo, analyzed by mediaanalysisd ~72-78% CPU), `server-data/` (SQLite +
     * WAL rewritten continuously), `logs/`, and `state/`. On a busy box whose
     * ~/.instar was never excluded, these pinned mediaanalysisd + mds_stores. Drops a
     * marker inside each high-churn subdir (gitignored runtime trees → no git noise);
     * honored recursively, harmless on non-macOS, idempotent, graceful no-op for a
     * brand-new agent whose subdirs don't exist yet.
     */
    private migrateAgentDataSpotlightExclusion;
    private migrateWorktreeConvention;
    /**
     * Async migration superset — runs the sync migrate() then performs the
     * async parity-renderings backfill that needs rule.remediate() Promises.
     * Callers in async contexts should prefer migrateAsync() to ensure all
     * post-update side effects (including primitive-rendering backfill) are
     * complete before returning.
     *
     * Sync callers can still use migrate() and rely on the next async pass to
     * pick up the parity backfill. The marker in _instar_migrations ensures
     * the backfill runs exactly once even across mixed sync/async callers.
     */
    migrateAsync(): Promise<MigrationResult>;
    private migrateParityRenderings;
    private migrateParitySentinelTrust;
    private migrateProviderPortability;
    private migrateFleetWatchdog;
    private migrateContextDeathAntiPattern;
    /**
     * Read `.instar/identity-pins.json` if present. Returns an object
     * keyed by marker id; missing file or malformed JSON yields `{}`
     * (soft-fail — a broken pin file shouldn't block every migration).
     */
    private readIdentityPins;
    /**
     * Upgrade built-in skills that hardcoded a localhost port at install time
     * to use a runtime-expandable ${INSTAR_PORT:-PORT} pattern.
     *
     * Background: installBuiltinSkills used to template the port at install.
     * Users who later changed their server port ended up with stale URLs in
     * their skills. This migration rewrites `http://localhost:NNNN/` to
     * `http://localhost:${INSTAR_PORT:-NNNN}/` in the known-default skill set.
     *
     * Idempotent: skips files that already use the dynamic pattern.
     * Scoped: only touches skills from the installBuiltinSkills set — custom
     * skills are never modified.
     */
    private migrateSkillPortHardcoding;
    /**
     * Update the /build skill with the GSD-cherry-pick methodology sections
     * (Phase 0.5 must-haves + STRIDE, atomic-commit discipline, SUMMARY
     * deviation-tracking). installBuildSkill is install-if-missing, so existing
     * agents need an explicit content-update migration.
     *
     * Idempotent + conservative: only re-copies the bundled SKILL.md when the
     * installed copy (a) lacks the new "Phase 0.5: MUST-HAVES" marker AND
     * (b) still looks like the stock /build skill (contains "Rigorous Build
     * Skill" + "Phase 5: COMPLETE"). A heavily-customized /build skill that no
     * longer matches the stock fingerprint is left untouched.
     */
    private migrateBuildSkillMethodology;
    /**
     * Update the deployed test-as-self SKILL.md to the Part 2.1 version that leads
     * with the one-button `instar test-as-self` command (manual recipe demoted to
     * fallback). installBuiltinSkills is install-if-missing, so existing agents
     * never get the updated content through init — this dedicated migration is the
     * only path (Migration Parity Standard, "updating existing skill content").
     *
     * Idempotent + conservative: re-copy the bundled SKILL.md only when the
     * installed copy (a) lacks the Part 2.1 MARKER AND (b) still matches the stock
     * FINGERPRINT. A customized skill is left untouched.
     */
    private migrateTestAsSelfSkill;
    /**
     * Update the deployed instar-dev skill so every fleet-development cycle
     * re-grounds its build location before source edits. This backfills the
     * mentor-onboarding hardening learned from Codey building a PR from a stale
     * agent-home checkout instead of current JKHeadley/main.
     *
     * Idempotent + conservative: re-copy the bundled SKILL.md only when the
     * installed copy (a) lacks the build-location marker AND (b) still matches
     * the stock instar-dev fingerprint. A customized skill is left untouched.
     */
    private migrateInstarDevBuildLocationRegrounding;
    /**
     * Update the deployed instar-dev skill so existing agents learn the
     * internal-only release-note lane added to the shared release-note assembler
     * and pre-push gate.
     *
     * Idempotent + conservative: re-copy the bundled SKILL.md only when the
     * installed copy (a) lacks the new lane marker AND (b) still matches the
     * stock instar-dev fingerprint. A customized skill is left untouched.
     */
    private migrateInstarDevInternalOnlyReleaseNoteLane;
    /**
     * Update the deployed spec-converge skill so existing agents get the
     * Lessons-aware reviewer's clause (d) FOUNDATION/SUBSYSTEM AUDIT — the review
     * must reach one layer below the spec boundary and weigh the subsystem the
     * spec tests/extends/builds-on against known standards, not just the spec's
     * own surface. This is the structural fix for the gap that let a test-harness
     * spec converge cleanly while the permission gate it proved still held brittle
     * blocking authority in violation of Signal-vs-Authority (2026-06-09): the
     * convergence audited only the harness and took the flawed foundation as given.
     *
     * Idempotent + conservative: re-copy the bundled SKILL.md only when the
     * installed copy (a) lacks the clause-(d) marker AND (b) still matches the
     * stock spec-converge fingerprint. A customized skill is left untouched.
     */
    private migrateSpecConvergeFoundationAudit;
    /**
     * Update the deployed autonomous skill files (stop hook + setup script) to the
     * current bundled versions. This covers both the topic-keyed ownership fix
     * (v1.2.55: restarts no longer silently kill autonomy) AND multi-session
     * per-topic state (each topic runs its own autonomous job from
     * .instar/autonomous/<topicId>.local.md).
     *
     * installAutonomousSkill() is install-if-missing, so existing agents never get
     * these through init — a dedicated migration is the only path (Migration Parity
     * Standard, "updating existing skill content").
     *
     * Idempotent + conservative per file: re-copy the bundled file only when the
     * installed copy (a) lacks the current capability MARKER AND (b) still matches
     * the stock FINGERPRINT. A customized file is left untouched. The marker is the
     * multi-session signature so v1.2.55 topic-keyed installs (which lack it) still
     * receive this upgrade.
     */
    private migrateAutonomousStopHookTopicKeyed;
    /**
     * Deploy any missing built-in skills (e.g., guardian job skills added after initial setup).
     * Non-destructive — only writes SKILL.md files that don't already exist.
     */
    private migrateBuiltinSkills;
    /**
     * Phase 2 — install/refresh built-in agentmd jobs. Copies the shipped
     * markdown templates into `.instar/jobs/instar/` and writes their
     * per-slug manifests. Honors operator-disabled state (preserves
     * `enabled: false` + `disabledAtBodyHash` across updates). Retires
     * jobs that are no longer shipped.
     *
     * The `.instar/jobs/user/` namespace is structurally untouched (Seamless
     * Migration Guarantee invariant 4).
     */
    private migrateBuiltinJobs;
    /**
     * Phase 5 — auto-run `instar jobs migrate` for pre-spec agents on update.
     *
     * Behavior:
     *   - SKIP entirely if `.instar/jobs/.migration-complete.json` exists
     *     (operator already confirmed completion via Dashboard).
     *   - SKIP entirely if `.instar/jobs/.migration-abandoned.json` exists
     *     (operator explicitly chose to roll back).
     *   - SKIP if `.instar/jobs.json` is absent (nothing to migrate).
     *   - Otherwise, invoke `jobsMigrate({ defaultAction: 'fork' })` —
     *     fork policy preserves the operator's customized body in user/
     *     namespace, never silently drops content. This is the
     *     spec-mandated default for the auto-run path.
     *   - Emit a Dashboard banner event via the migration result so the
     *     operator sees "migration ran on update — confirm in Dashboard."
     *
     * Seamless Migration Guarantee invariants enforced at this layer
     * (PR #180 §Seamless Migration Guarantee):
     *   #6 in-flight protection — JobScheduler.activeRuns() check is
     *      currently a defensive no-op until Phase 4 wires the scheduler
     *      back-reference; the migration runs at update time, before the
     *      new scheduler instance comes up, so by construction nothing is
     *      in flight.
     *   #7 transactional safety on interrupt — `jobsMigrate` is structurally
     *      safe (backup-first, idempotent, rollback via --abandon).
     *   #8 telemetry — outcome is appended to result.upgraded/errors.
     */
    private autoMigrateLegacyJobsJson;
    /** Read the installed package's version, for the migration event's
     *  `instarVersion` field. Best-effort — returns undefined on failure. */
    private readBundledInstarVersion;
    /** Best-effort telemetry write. Missing telemetry is degradation, not a
     *  release-blocker, so failures are swallowed. */
    private appendMigrationTelemetry;
    /**
     * Re-install hooks with the latest templates.
     * Built-in hooks in instar/ are always overwritten.
     * Custom hooks in custom/ are never touched.
     */
    private migrateHooks;
    /**
     * Scan .claude/settings.json for hook `command:` entries that reference files
     * under the instar hooks tree, and report any that don't exist on disk.
     *
     * Structural invariant check — runs at upgrade time, emits into result.errors
     * so the upgrade log surfaces the drift. Not fatal: unknown hooks may be
     * agent-custom (lives under .instar/hooks/custom/) and we don't want to wedge
     * an upgrade on a reference we don't own.
     */
    validateHookReferences(hooksDir: string, result: MigrationResult): void;
    /**
     * Migrate hooks from flat .instar/hooks/ layout to .instar/hooks/instar/ subdirectory.
     * Detects agent-modified built-in hooks by comparing content hashes and moves them
     * to .instar/hooks/custom/ with provenance 'inherited'.
     */
    private migrateHookLayout;
    /**
     * Migrate settings.json hook command paths from .instar/hooks/X to .instar/hooks/instar/X.
     * This handles the transition for agents that already have hooks configured.
     */
    private migrateSettingsHookPaths;
    /**
     * Migrate HTTP hook URLs to include INSTAR_SESSION_ID query parameter.
     * This enables the server to map Claude Code's session_id to the instar session,
     * which is required for subagent-aware zombie cleanup (prevents killing sessions
     * that are waiting for subagent results).
     *
     * Finds HTTP hooks with URLs ending in /hooks/events (no query params) and
     * appends ?instar_sid=${INSTAR_SESSION_ID}. Also adds INSTAR_SESSION_ID to
     * allowedEnvVars if missing.
     */
    private migrateHttpHookSessionId;
    /**
     * Ensure HTTP hooks from the template exist in settings.json.
     * Previous migrations only patched existing HTTP hooks (adding instar_sid param)
     * but never added them from scratch. Agents initialized before HTTP hooks were
     * introduced have no HTTP hooks at all, causing claudeSessionId to never be
     * populated — which breaks session resume (falls back to mtime cross-contamination).
     */
    private ensureHttpHooksExist;
    /**
     * Ensure PermissionRequest auto-approve hook exists in settings.json.
     * Subagents spawned via the Agent tool don't inherit --dangerously-skip-permissions,
     * so without this catch-all hook they prompt for every tool use and block jobs.
     * Real safety is in PreToolUse hooks — permission prompts are duplicative friction.
     */
    private ensurePermissionAutoApprove;
    /**
     * Ensure autonomous stop hook is registered and the skill files are deployed.
     * This is the structural enforcement for /autonomous mode — without it,
     * sessions exit normally after each response instead of looping on the task list.
     */
    private ensureAutonomousStopHook;
    /**
     * Replace HTTP hooks with command hooks that use hook-event-reporter.js.
     * Claude Code HTTP hooks (type: "http") silently fail to fire as of v2.1.78.
     * This migration converts them to command hooks which reliably fire.
     * The hook-event-reporter.js script itself is installed by migrateHooks()
     * (always-overwrite pattern for built-in hooks).
     */
    private migrateHttpHooksToCommandHooks;
    private getHookEventReporterScript;
    /**
     * Patch CLAUDE.md with any new sections that don't exist yet.
     * Only adds — never modifies or removes existing content.
     */
    private migrateClaudeMd;
    /**
     * Mirror capability-instruction sections from the freshly-patched CLAUDE.md
     * into any non-Claude framework shadows (AGENTS.md, GEMINI.md) that exist
     * on disk. Portability audit Gap 6 minimal-shim implementation:
     * `generateClaudeMd` + `migrateClaudeMd` produce a rich capability/
     * instructions document for Claude Code, but Codex/Gemini shadows had no
     * equivalent — agents on those runtimes received the canonical identity
     * (Gap 1, shipped) but none of the "here's what you can do" sections.
     *
     * The shim slices each known capability section out of CLAUDE.md (from its
     * marker through the start of the next top-level heading) and appends any
     * section missing from the shadow. The section bodies are NOT duplicated
     * — they are literally copied from the just-patched CLAUDE.md, so the two
     * cannot drift. Runs AFTER `migrateClaudeMd` so the source is current.
     *
     * Idempotent: each section is only appended when its marker is absent from
     * the shadow. No-op when CLAUDE.md is absent or no shadow exists. Safe for
     * Claude-only installs (they have no AGENTS.md/GEMINI.md so nothing
     * happens). A full refactor that extracts the section *bodies* into a
     * shared array is deliberately NOT done here per the operator's
     * "minimal shim" decision — that would touch ~360 lines of inline content
     * in `migrateClaudeMd` and is high-risk for low marginal benefit.
     */
    private migrateFrameworkShadowCapabilities;
    /**
     * Install any new scripts that don't exist yet.
     * Never overwrites existing scripts (user may have customized them).
     */
    private migrateScripts;
    /**
     * Secret-externalization survivability migration.
     *
     * On first multi-machine pairing, `SecretMigrator` moves authToken out of
     * plaintext config.json into the encrypted secret store and replaces the
     * on-disk field with the literal `{ "secret": true }` placeholder. Any
     * shipped script that reads authToken directly from config.json then sends
     * the placeholder as a Bearer token and the server returns 403 silently —
     * the script just emits nothing. This caused the 2026-05-29 incident where
     * the telegram topic-history injection hook stopped firing and the agent
     * came back from compaction with no idea what the user had been saying.
     *
     * The canonical hook scripts (session-start.sh, compaction-recovery.sh,
     * telegram-topic-context.sh) are always-overwritten by the existing
     * `migrateHooks()` path, so this method only addresses the auxiliary
     * shipped scripts that aren't on the always-overwrite track: the messaging
     * channel-context hook (slack-channel-context.sh), the iMessage reply
     * script, and the serendipity-capture helper. Telegram/Slack/WhatsApp
     * reply scripts have their own SHA-based migrators that already detect
     * stale auth-handling via the extended-marker check in
     * `migrateReplyScriptTo408()`.
     *
     * The detection is structural: the file is upgraded iff
     *   1. it exists at the expected path,
     *   2. it contains the shipped header marker (so we don't touch custom
     *      forks),
     *   3. AND it does NOT contain `INSTAR_AUTH_TOKEN` (the env-first canary
     *      that proves the new resolver pattern is in place).
     *
     * Idempotent: re-running after the upgrade finds (3) violated, so it
     * skips silently.
     */
    private migrateSecretExternalizationSurvivability;
    /**
     * Ensure .claude/settings.json has required MCP servers and correct hook wiring.
     * Migrates legacy PostToolUse/Notification hooks to proper SessionStart type.
     */
    private migrateSettings;
    /**
     * Migrate the agent's config.json with sensible defaults for new features.
     * Only adds missing fields — never overwrites existing user customizations.
     */
    private migrateConfig;
    /**
     * Fix gitignore entries that shouldn't exclude shared state.
     * Removes relationships/ from gitignore so multi-machine agents share awareness.
     */
    /**
     * Generate self-knowledge tree for agents that don't have one.
     * Uses managed/unmanaged merge if one already exists.
     */
    /**
     * Canonical maxSessions migration — codex-instar audit Item 10.
     *
     * Older agent configs used a top-level `maxSessions` field; the current
     * canonical location is `sessions.maxSessions`. Some agents (echo as of
     * 2026-05-22) carry BOTH keys, with divergent values — the legacy key is
     * dead in code today (after audit Item 2's fallback chain reads canonical
     * first), but it's still cruft and still misleading to anyone reading the
     * file.
     *
     * Logic:
     *  - If only canonical key → no-op (skip).
     *  - If neither key → no-op (skip).
     *  - If only legacy key → copy to canonical, delete legacy.
     *  - If both → keep canonical, delete legacy (canonical wins; legacy is
     *    presumed stale because it was historically the only source).
     *
     * Idempotent: subsequent runs find no legacy key and skip.
     */
    private migrateLegacyMaxSessions;
    /**
     * Retire `mentor.dailySpendCapUsd` — a config field that was DECORATIVE (read nowhere
     * in code; spec MENTOR-LIVE-READINESS §Migration parity called it out as the
     * silent-dead-config bug we shouldn't repeat at migration time). On a Claude
     * subscription there's no per-token dollar charge to cap; the real budget is quota-
     * aware (a separate future PR ships `mentor.stageBTokenCeiling`).
     *
     * Behavior:
     *  - field absent → silent skip
     *  - field present at the default (0.5) → silent delete (no warning)
     *  - field present at a NON-default value → delete + LOUD `result.upgraded` entry with
     *    a REVIEW prefix (operator never set this thinking it was enforced; they deserve
     *    to know). Don't repeat the original silent-dead-config bug at migration time.
     * Idempotent via the `_instar_migrations` marker.
     */
    private migrateRetireDeadMentorConfig;
    /**
     * Retire the legacy `{stateDir}/mentor-outbox/` directory — the file-based mentor
     * delivery design that Justin's substrate correction replaced (spec MENTOR-LIVE-
     * READINESS §Migration parity). The new mentor delivery goes through the agent-to-
     * agent Telegram comms primitive (sendAgentMessage); the outbox files are now dead
     * state and should be swept so they don't accumulate or mislead a future operator.
     *
     * Idempotent via the `_instar_migrations` marker. The first run deletes if present;
     * subsequent runs are no-ops. Best-effort — a removal failure logs + continues.
     */
    private migrateRetireMentorOutbox;
    private migrateSelfKnowledgeTree;
    private migrateGitignore;
    /**
     * PR-REVIEW-HARDENING Phase A — ensure pr-gate state paths are backed up.
     *
     * Uses the `config.backup.includeFiles` plumbing shipped in commit 2
     * (see src/core/BackupManager.ts + src/config/ConfigDefaults.ts). The
     * BackupManager's constructor unions these entries with
     * DEFAULT_CONFIG.includeFiles at snapshot time — this migrator just
     * persists the extra entries into the user's config.json so they
     * survive process restarts and git-sync.
     *
     * Paths added to `config.backup.includeFiles`:
     *   - .instar/state/pr-pipeline.jsonl*       (pipeline event log + rotations)
     *   - .instar/state/pr-gate/phase-a-sha.json (grandfathering-boundary SHA)
     *   - .instar/state/pr-debounce.jsonl        (PR-wave debounce window)
     *   - .instar/state/pr-debounce-archive.jsonl
     *   - .instar/state/pr-cost-ledger.jsonl     (daily cost accounting)
     *   - .instar/state/security.jsonl*          (auth + revocation events)
     *
     * Topic Profile (TOPIC-PROFILE-SPEC §12, round-5/6): the profile store
     * (`state/topic-profiles.json`) and the operator-binding store it
     * authorizes against (`state/topic-operators.json`) join the same union —
     * both are durable operator intent, exactly the identity/continuity class
     * the backup protects (a restore must not produce pins whose bound
     * operator is absent). The resume maps (topic-resume-map /
     * codex-resume-map) are machine-local ephemera and deliberately EXCLUDED
     * — they reference transcripts that don't travel.
     *
     * PATH SHAPE IS PINNED (round-6 integration): the topic-profile entries
     * are stateDir-RELATIVE (`state/...`), NEVER `.instar/state/...` —
     * BackupManager.createSnapshot() joins each entry onto a stateDir that
     * already IS `<project>/.instar`, so an `.instar/`-prefixed entry
     * silently never matches anything (a dead manifest entry that loses
     * every operator pin on restore).
     *
     * Set-union semantics preserve user-added entries. Idempotent on
     * re-run. Atomic write (temp → fsync → rename).
     *
     * Safety assertion: no entry under .instar/secrets/ is ever allowed
     * into the merged list. BackupManager.BLOCKED_PATH_PREFIXES (commit 1)
     * is the authoritative enforcement; this migrator-level assertion is
     * defense-in-depth and logs a warning if violated.
     */
    private migrateBackupManifest;
    /**
     * PR-REVIEW-HARDENING Phase A — ship pr-gate pipeline artifacts.
     *
     * Writes four shipped files:
     *   - scripts/pr-gate/eligibility-schema.sql   (all agents)
     *   - .claude/skills/fork-and-fix/scripts/push-gate.sh  (all agents, 0755)
     *   - .github/workflows/instar-pr-gate.yml     (instar source repo only)
     *   - docs/pr-gate-setup.md                    (instar source repo only)
     *
     * Each write is gated by sha256(content) === expectedHash. A tamperer
     * who modifies the content string in the published JS without also
     * updating the hash constant trips this assertion; migration aborts
     * for that file and logs a critical error.
     *
     * Idempotent: files whose on-disk content already matches the shipped
     * content are skipped (no rewrite).
     *
     * Phase A landing: endpoints are inert (prGate.phase='off') so these
     * artifacts have no runtime consumer yet. Later phases activate them.
     */
    private migratePrPipelineArtifacts;
    /**
     * Write a shipped artifact with content-hash verification. Idempotent:
     * skips write if on-disk content already matches. Aborts with a logged
     * error if sha256(content) !== expectedSha256 (detects post-publish
     * tamper of one side without the other).
     */
    private writeShippedArtifact;
    /**
     * Detect whether this agent lives in the JKHeadley/instar source repo.
     * Two-signal check: normalized `git remote get-url origin` (or upstream
     * if origin is a fork) points at github.com/JKHeadley/instar, AND
     * package.json.name === 'instar'. Both must match — the package-name
     * check prevents writing the workflow to a fork that happens to have
     * a different package name.
     *
     * Silent false on any error (no git, no package.json, parse failure):
     * non-instar agents should NOT have workflow/docs files dropped on them.
     */
    private isInstarSourceRepo;
    /**
     * Idempotently add a .gitignore entry. No-op if the entry is already
     * present as an active (non-comment, non-blank) line. Creates the file
     * if it doesn't exist. A comment line that happens to contain the entry
     * text is NOT treated as present — only exact-match active lines count.
     */
    private addGitignoreEntry;
    private removeGitignoreEntry;
    /**
     * Opt-in soul.md migration for existing agents.
     * Does NOT auto-create soul.md — adds config flag and queues notification.
     */
    private migrateSoulMd;
    /**
     * Add Self-Observations and Identity History sections to existing AGENT.md.
     */
    private migrateAgentMdSections;
    /**
     * Get the content of a named hook template.
     * Used by init.ts to share canonical hook content without duplication.
     */
    getHookContent(name: 'session-start' | 'mcp-health-autorefresh' | 'compaction-recovery' | 'external-operation-gate' | 'deferral-detector' | 'self-stop-guard' | 'slopcheck-guard' | 'post-action-reflection' | 'external-communication-guard' | 'scope-coherence-collector' | 'scope-coherence-checkpoint' | 'claim-intercept' | 'claim-intercept-response' | 'telegram-topic-context' | 'response-review' | 'stop-gate-router' | 'auto-approve-permissions' | 'skill-usage-telemetry' | 'build-stop-hook' | 'model-tier-skill-entry' | 'model-tier-reconciler'): string;
    /** Public accessor for grounding-before-messaging hook content (used by init.ts) */
    getGroundingBeforeMessagingPublic(): string;
    /** Public accessor for convergence-check script content (used by init.ts) */
    getConvergenceCheckPublic(): string;
    /**
     * mcp-health-autorefresh.sh — auto-recover from an allowlisted MCP that failed
     * to register this session, by self-/sessions/refresh ONCE (loop-guarded).
     *
     * Justin's ask (2026-06-02, topic 13481): "if [an MCP is] inaccessible, you
     * restart your session so it can be accessible in the next session. This should
     * be AUTOMATIC, a known protocol in process." A configured MCP reporting
     * "Failed to connect" in `claude mcp list` means its tools are missing this
     * boot; a fresh session re-launches it and it connects on retry (proven live:
     * playwright was unregistered, came up Connected after one /sessions/refresh).
     *
     * SAFETY (high blast radius — it restarts a session):
     *  - DARK by default: only runs when config.mcpAutoRefresh.enabled === true.
     *  - ALLOWLISTED: only refreshes for config.mcpAutoRefresh.servers (default
     *    ["playwright"]) — an arbitrary optional MCP failing never triggers a restart.
     *  - HARD LOOP-GUARD: a marker keyed on (sessionId, failed-set). If we already
     *    refreshed THIS session for THIS exact failed-set, the failure is persistent
     *    (not a transient race) → do NOT refresh again; surface instead. So it can
     *    refresh at most ONCE per session and can NEVER restart-loop the fleet.
     *  - Backgrounded by session-start.sh so it never blocks boot.
     */
    private getMcpHealthAutorefreshHook;
    private getSessionStartHook;
    private getDangerousCommandGuard;
    private getGroundingBeforeMessaging;
    private getConvergenceCheckInline;
    private getTelegramTopicContextHook;
    private getCompactionRecovery;
    private getDeferralDetectorHook;
    private getSelfStopGuardHook;
    private getSlopcheckGuardHook;
    private getPostActionReflectionHook;
    private getExternalCommunicationGuardHook;
    private getActionClaimFollowthroughHook;
    private getPrHandLeaseGuardHook;
    private getExternalOperationGateHook;
    /**
     * Apply the HTTP 408 ambiguous-outcome migration to an existing reply script
     * if and only if:
     *   - the file exists (we never install these from here — only upgrade),
     *   - its header matches the shipped version (so we don't stomp custom scripts),
     *   - and it does NOT already handle HTTP 408.
     *
     * Used by migrateScripts() for slack-reply.sh and whatsapp-reply.sh. The
     * telegram-reply.sh migration uses similar logic inline because it ALSO
     * installs on first run (hasTelegram gate); these two are upgrade-only.
     */
    /**
     * Known-shipped SHA-256 hashes of `src/templates/scripts/telegram-reply.sh`.
     *
     * The migrator overwrites an on-disk copy only when its SHA matches one
     * of these — meaning it is a verbatim prior shipped version. Any other
     * content (user customization, partial edits, accidental damage) is
     * preserved. The new template is written alongside as `.new` and a
     * degradation event is raised so the operator can resolve it manually.
     *
     * Add the prior shipped SHA when shipping a new template; never remove
     * old SHAs (they remain valid migration sources).
     */
    static readonly TELEGRAM_REPLY_PRIOR_SHIPPED_SHAS: ReadonlySet<string>;
    /**
     * SHA-based migrator for telegram-reply.sh — replaces marker-string
     * detection with content-hash detection. See spec
     * docs/specs/telegram-delivery-robustness.md § Layer 1 "Migration".
     *
     * Three branches:
     *   - on-disk SHA ∈ prior-shipped → back up and overwrite with new template.
     *   - on-disk SHA == new-template SHA → no-op (idempotent).
     *   - otherwise → write `<scriptPath>.new`, raise a
     *     `relay-script-modified-locally` degradation event, leave the
     *     original untouched.
     */
    private migrateReplyScriptToPortConfig;
    private migrateReplyScriptTo408;
    /**
     * Read a reply-script template from src/templates/scripts/.
     * Returns null if the template file cannot be located (shouldn't happen in
     * a healthy install). The caller is responsible for handling the null case.
     */
    private loadRelayTemplate;
    private getTelegramReplyScript;
    private getHealthWatchdog;
    private getConvergenceCheck;
    private getScopeCoherenceCollectorHook;
    private getScopeCoherenceCheckpointHook;
    private getFreeTextGuardHook;
    private getClaimInterceptHook;
    private getResponseReviewHook;
    private getStopGateRouterHook;
    private getClaimInterceptResponseHook;
    private getSkillUsageTelemetryHook;
    private getModelTierSkillEntryHook;
    private getModelTierReconcilerHook;
    private getBuildStopHook;
    private getAutoApprovePermissionsHook;
}
//# sourceMappingURL=PostUpdateMigrator.d.ts.map