import { type VerifiedOperator } from '../core/PrincipalGuard.js';
/**
 * WS2.6 topic-operator-record replication emit seam (injected, dark by default). server.ts
 * late-binds a journal-backed emitter ONLY when `multiMachine.stateSync.topicOperator.enabled` is
 * true; absent ⇒ strict no-op (single-machine, byte-identical). The emitter NEVER throws into the
 * store (it swallows + counts internally), so the store calls it best-effort.
 *
 * THE LOAD-BEARING INVARIANT: this seam only EMITS the LOCAL authoritative binding to peers — it
 * never RECEIVES one. A replicated topic-operator record can NEVER establish/override the local
 * operator (that path does not exist by construction). emitPut carries the disclosure-minimized
 * projection {platform, uid, names, boundAt} keyed on sha256(topicId + ":" + verified-uid).
 */
export interface TopicOperatorReplicationEmitter {
    /** Emit a `put` for a freshly-bound (or re-bound) topic operator (called from setOperator). */
    emitPut(topicId: number | string, record: TopicOperator): void;
}
/** The stored operator record for a topic. */
export interface TopicOperator {
    /** The channel the operator is verified on. */
    platform: 'telegram' | 'whatsapp' | 'slack' | string;
    /** The platform-verified sender id (the authority). */
    uid: string;
    /** Display name(s), lowercased — for matching the agent's prose. */
    names: string[];
    /** ISO timestamp the binding was established (caller-provided, since Date is
     *  unavailable in some sandboxes; defaults to '' when omitted). */
    boundAt: string;
    /** Provenance: always 'authenticated-inbound' (never a content name). */
    boundFrom: 'authenticated-inbound';
}
export declare class TopicOperatorStore {
    private readonly file;
    private cache;
    /** WS2.6 topic-operator-record replication emitter (injected, dark by default). Absent ⇒ strict no-op. */
    private operatorReplication;
    constructor(stateDir: string);
    /**
     * Late-bind the WS2.6 topic-operator-record replication emitter (server.ts constructs the
     * journal/clock AFTER the store). Idempotent; passing undefined/null detaches (back to
     * single-machine no-op). The emit funnel checks `this.operatorReplication` per bind, so
     * attaching mid-life takes effect on the next setOperator.
     */
    setOperatorReplicationEmitter(emitter: TopicOperatorReplicationEmitter | null | undefined): void;
    private load;
    private save;
    /**
     * Establish (or replace) a topic's operator from the AUTHENTICATED sender.
     * Returns the stored record, or null if the uid is blank (which is refused —
     * an operator cannot be established without a verified id, and a content name
     * is never accepted).
     */
    setOperator(topicId: number | string, input: {
        platform: string;
        uid: string;
        displayName?: string;
        boundAt?: string;
    }): TopicOperator | null;
    /** Read a topic's verified operator, or null if unbound. */
    getOperator(topicId: number | string): TopicOperator | null;
    /** Convert a stored record back to the PrincipalGuard `VerifiedOperator`
     *  shape (for `evaluatePrincipalCoherence`). Null when the topic is unbound. */
    asVerifiedOperator(topicId: number | string): VerifiedOperator | null;
    /** All bound topics → operator. */
    all(): Record<string, TopicOperator>;
    /**
     * The session-start injection block (modeled on /intent/org/session-context).
     * Returns the `<topic-operator>` element the session-start hook injects so the
     * agent reasons with its verified operator from message one — or null when the
     * topic has no bound operator (nothing injected). The display name is the
     * first known name, title-cased for readability; the uid is authoritative.
     */
    sessionContextBlock(topicId: number | string): string | null;
}
//# sourceMappingURL=TopicOperatorStore.d.ts.map