/**
 * Agent Server — HTTP server wrapping Express.
 *
 * Provides health checks, session management, job triggering,
 * and event querying over a simple REST API.
 *
 * Also serves the dashboard UI at /dashboard and handles
 * WebSocket connections for real-time terminal streaming.
 */
import { type Express } from 'express';
import { TopicOperatorStore } from '../users/TopicOperatorStore.js';
import type { SessionManager } from '../core/SessionManager.js';
import type { StateManager } from '../core/StateManager.js';
import type { JobScheduler } from '../scheduler/JobScheduler.js';
import type { TelegramAdapter } from '../messaging/TelegramAdapter.js';
import type { MessageRouter } from '../messaging/MessageRouter.js';
import type { InstarConfig } from '../core/types.js';
import type { RelationshipManager } from '../core/RelationshipManager.js';
import type { FeedbackManager } from '../core/FeedbackManager.js';
import type { DispatchManager } from '../core/DispatchManager.js';
import type { UpdateChecker } from '../core/UpdateChecker.js';
import type { AutoUpdater } from '../core/AutoUpdater.js';
import type { AutoDispatcher } from '../core/AutoDispatcher.js';
import type { QuotaTracker } from '../monitoring/QuotaTracker.js';
import type { TelegraphService } from '../publishing/TelegraphService.js';
import type { PrivateViewer } from '../publishing/PrivateViewer.js';
import type { TunnelManager } from '../tunnel/TunnelManager.js';
import type { EvolutionManager } from '../core/EvolutionManager.js';
import type { SessionWatchdog } from '../monitoring/SessionWatchdog.js';
import type { StallTriageNurse } from '../monitoring/StallTriageNurse.js';
import type { MultiMachineCoordinator } from '../core/MultiMachineCoordinator.js';
import type { TopicMemory } from '../memory/TopicMemory.js';
import type { FeedbackAnomalyDetector } from '../monitoring/FeedbackAnomalyDetector.js';
import { SelfUnblockChecklist } from '../monitoring/SelfUnblockChecklist.js';
import type { TopicIntentStore } from '../core/TopicIntent.js';
import type { WorktreeManager } from '../core/WorktreeManager.js';
import { ParallelWorkSentinel } from '../monitoring/ParallelWorkSentinel.js';
import { type MentorConfig } from '../scheduler/MentorOnboardingRunner.js';
import { EscalationGovernor } from '../core/EscalationGovernor.js';
import { ModelSwapService } from '../core/ModelSwapService.js';
import { EscalationHintStore } from '../core/EscalationHintStore.js';
export declare function readMentorConfigFromDisk(stateDir: string | undefined, fallback: MentorConfig): MentorConfig;
/**
 * The request-time wiring for the live-test capstone runner (§6/§7.5). The route
 * builds a RealChannelDriver from whatever demo creds exist and calls `makeRunner`
 * to get a LiveTestRunner whose harness wraps that driver — sharing `artifactStore`
 * with the LiveTestGate so a run's artifact is exactly the artifact the gate verifies.
 */
export interface LiveTestRunnerWiring {
    artifactStore: import('../core/LiveTestArtifactStore.js').LiveTestArtifactStore;
    runnerFingerprint: string;
    /** Build a LiveTestRunner whose harness wraps the request-built driver (seat-move-first orchestration). */
    makeRunner: (driver: import('../core/LiveTestHarness.js').ChannelDriver) => import('../core/LiveTestRunner.js').LiveTestRunner;
    /** Build the harness directly (for running the richer §7.5 matrix after the seat-move gate). */
    makeHarness: (driver: import('../core/LiveTestHarness.js').ChannelDriver) => import('../core/LiveTestHarness.js').LiveTestHarness;
    /**
     * Optional injection seam: when present, the route uses THIS to build the request's
     * ChannelDriver instead of constructing the real Telegram/Slack senders from config.
     * Production leaves it undefined (the route builds the real, fail-closed driver);
     * tests provide a fake driver so a wired run can be exercised with no live network.
     */
    driverForRequest?: () => import('../core/LiveTestHarness.js').ChannelDriver;
    /**
     * Optional injection seam for the seat-move action. Production leaves it undefined
     * (the route POSTs the local /pool/transfer and reads the honest seatMoved signal);
     * tests inject a deterministic transfer so the capstone can be exercised end-to-end
     * without a live multi-machine pool.
     */
    transferForRequest?: (topicId: string, toMachine: string) => Promise<{
        seatMoved: boolean;
        detail?: string;
    }>;
}
export declare class AgentServer {
    private app;
    private server;
    private wsManager;
    private config;
    private startTime;
    private sessionManager;
    private state;
    private hookEventReceiver?;
    private streamTicketStore?;
    private poolStreamAllowRemoteInput;
    private poolStreamConnector?;
    private poolLink?;
    private poolPollCache?;
    private meshSelfId?;
    private routeContext;
    private deliverySentinel;
    private deliveryStore;
    private toneGate;
    private tokenLedger;
    private featureMetricsLedger;
    private featureMetricsPruneTimer;
    private a2aDeliveryTracker;
    private tokenLedgerPoller;
    private resourceLedger;
    private resourceLedgerPoller;
    /** Approval-as-Data ledger (spec Part B, Phase 2). Read-only observability over
     *  operator approval decisions. Null when stateDir is unavailable. */
    private approvalLedger;
    /** Verified per-topic operator binding (Know Your Principal #898, increment 2).
     *  The principal whose decisions the agent enacts in a topic, established ONLY
     *  from the authenticated sender uid. Null when stateDir is unavailable. */
    private topicOperatorStore;
    /** Coordination Mandate enforcement (spec §4): deny-by-default gate + signed
     *  store + hash-chained audit. Null when stateDir is unavailable. */
    private coordination;
    /** WS5.2 R4a — durable store of cross-machine-DELIVERED account-follow-me mandates (target side).
     *  Null when coordination/stateDir is unavailable. */
    private deliveredMandateStore;
    /** Operator Authorization Request (agent proposes → operator approves one-tap). Null
     *  when coordination/stateDir is unavailable. `enabled` is the resolved dev-gate. */
    private authorizationRequests;
    private cutoverReadiness;
    /** Option-B receiving end (feedback-factory-migration Q2b): drains the cloud
     *  Blob inbox into the durable canonical JsonlFeedbackStore. Null when dark
     *  (feedbackFactory.receiverPersistence.enabled !== true) → route 503s. */
    private inboxDrainer;
    /** Feedback-factory processing trigger (feedback-factory-migration §191): backs
     *  GET /feedback-factory/stats + POST /feedback-factory/process. Dev-gated —
     *  constructed only when resolveDevAgentGate(feedbackFactory.processing.enabled)
     *  is live; null on the fleet → both routes 503. */
    private feedbackProcessing;
    private parallelActivityIndex;
    private parallelWorkSentinel;
    private parallelWorkSentinelTimer;
    private resourceSampler;
    private frameworkIssueLedger;
    private mentorRunner;
    /** Wall-clock of the last mentor tick that ran, for the min-interval floor. */
    private mentorLastTickAt;
    /** UTC day + run count for the per-day mentor cap (resets across days). */
    private mentorDayKey;
    private mentorRunsToday;
    /** Lazily-constructed second TelegramAdapter for the mentor bot (gated on
     *  mentor.botToken). Per-token-cached so config reloads with the same token reuse the
     *  same adapter (avoids leaking a new bot poll loop on every send). Spec §Fix 2b. */
    private mentorBotAdapter;
    private mentorBotAdapterToken;
    /** Lazily-constructed a2a audit ledger (shared across mentor sends/recvs). */
    private a2aLedger;
    /** Lazily-constructed processed-id store (idempotency for inbound mentor-reply). */
    private a2aProcessedIds;
    /** Lazily-constructed outstanding-prompt tracker (anti-ping-pong). */
    private mentorOutstanding;
    /** Reply-jsonl path (Codey's reply persisted here for Stage-B forensics). */
    private mentorReplyJsonlPath;
    /** Sent-jsonl path (mentor prompts persisted here for Stage-A surface). */
    private mentorSentJsonlPath;
    private failureLedger;
    private failureAttributionEngine;
    private ciFailurePoller;
    private revertDetector;
    private correctionLedger;
    private blockerLedger;
    /** Self-Unblock checklist run store (the read surface + the store BlockerLedger verifies). */
    private selfUnblockRunStore;
    /**
     * The PRODUCTION Self-Unblock checklist — wired with real probe providers and the
     * durable run store. The PRODUCER half: routes RUN this to produce a verified
     * run (the gap that made settling a credential-blocker impossible until now).
     * Null when the self-unblock sub-feature is dark.
     */
    private selfUnblockChecklist;
    private growthMilestoneAnalyst;
    private growthDigestPublisher;
    private apprenticeshipProgram;
    private apprenticeshipCycleStore;
    private apprenticeshipCycleSlaMonitor;
    private geminiCapacityEscalationMonitor;
    private burnDetector;
    private burnThrottleRunbook;
    private burnVerifier;
    private modelTierSwap;
    private ultraCapMonitor;
    private escalationGovernorRef;
    private escalationHints;
    private telegramAdapter;
    constructor(options: {
        config: InstarConfig;
        sessionManager: SessionManager;
        state: StateManager;
        scheduler?: JobScheduler;
        telegram?: TelegramAdapter;
        relationships?: RelationshipManager;
        feedback?: FeedbackManager;
        dispatches?: DispatchManager;
        updateChecker?: UpdateChecker;
        autoUpdater?: AutoUpdater;
        autoDispatcher?: AutoDispatcher;
        quotaTracker?: QuotaTracker;
        publisher?: TelegraphService;
        viewer?: PrivateViewer;
        tunnel?: TunnelManager;
        evolution?: EvolutionManager;
        watchdog?: SessionWatchdog;
        triageNurse?: StallTriageNurse;
        topicMemory?: TopicMemory;
        feedbackAnomalyDetector?: FeedbackAnomalyDetector;
        projectMapper?: import('../core/ProjectMapper.js').ProjectMapper;
        cartographer?: import('../core/CartographerTree.js').CartographerTree;
        coherenceGate?: import('../core/ScopeVerifier.js').ScopeVerifier;
        contextHierarchy?: import('../core/ContextHierarchy.js').ContextHierarchy;
        canonicalState?: import('../core/CanonicalState.js').CanonicalState;
        operationGate?: import('../core/ExternalOperationGate.js').ExternalOperationGate;
        sentinel?: import('../core/MessageSentinel.js').MessageSentinel;
        adaptiveTrust?: import('../core/AdaptiveTrust.js').AdaptiveTrust;
        memoryMonitor?: import('../monitoring/MemoryPressureMonitor.js').MemoryPressureMonitor;
        orphanReaper?: import('../monitoring/OrphanProcessReaper.js').OrphanProcessReaper;
        coherenceMonitor?: import('../monitoring/CoherenceMonitor.js').CoherenceMonitor;
        commitmentTracker?: import('../monitoring/CommitmentTracker.js').CommitmentTracker;
        prHandLease?: import('../core/PrHandLease.js').PrHandLease;
        subscriptionPool?: import('../core/SubscriptionPool.js').SubscriptionPool;
        accountFollowMePeerViews?: import('./routes.js').RouteContext['accountFollowMePeerViews'];
        quotaPoller?: import('../core/QuotaPoller.js').QuotaPoller;
        quotaAwareScheduler?: import('../core/QuotaAwareScheduler.js').QuotaAwareScheduler;
        proactiveSwapMonitor?: import('../core/ProactiveSwapMonitor.js').ProactiveSwapMonitor;
        inUseAccountResolver?: import('../core/InUseAccountResolver.js').InUseAccountResolver;
        enrollmentWizard?: import('../core/EnrollmentWizard.js').EnrollmentWizard;
        accountFollowMeRevocation?: import('../core/AccountFollowMeRevocation.js').AccountFollowMeRevocation;
        credentialRepointing?: import('./routes.js').RouteContext['credentialRepointing'];
        semanticMemory?: import('../memory/SemanticMemory.js').SemanticMemory;
        activitySentinel?: import('../monitoring/SessionActivitySentinel.js').SessionActivitySentinel;
        rateLimitSentinel?: import('../monitoring/RateLimitSentinel.js').RateLimitSentinel;
        releaseReadinessSentinel?: import('../monitoring/ReleaseReadinessSentinel.js').ReleaseReadinessSentinel;
        greenPrAutoMerger?: import('../monitoring/GreenPrAutoMerger.js').GreenPrAutoMerger;
        guardLatchStore?: import('../monitoring/GuardLatchStore.js').GuardLatchStore;
        workingMemory?: import('../memory/WorkingMemoryAssembler.js').WorkingMemoryAssembler;
        quotaManager?: import('../monitoring/QuotaManager.js').QuotaManager;
        messageRouter?: MessageRouter;
        summarySentinel?: import('../messaging/SessionSummarySentinel.js').SessionSummarySentinel;
        spawnManager?: import('../messaging/SpawnRequestManager.js').SpawnRequestManager;
        systemReviewer?: import('../monitoring/SystemReviewer.js').SystemReviewer;
        capabilityMapper?: import('../core/CapabilityMapper.js').CapabilityMapper;
        selfKnowledgeTree?: import('../knowledge/SelfKnowledgeTree.js').SelfKnowledgeTree;
        coverageAuditor?: import('../knowledge/CoverageAuditor.js').CoverageAuditor;
        topicResumeMap?: import('../core/TopicResumeMap.js').TopicResumeMap;
        /** Topic Profile (TOPIC-PROFILE-SPEC) — store + resolver + write surface
         *  + shared confirm slots, constructed in server.ts. Backs the §9
         *  model-swap pin consult and the /topic-profile routes. */
        topicProfile?: {
            store: import('../core/TopicProfileStore.js').TopicProfileStore;
            resolver: import('../core/TopicProfileResolver.js').TopicProfileResolver;
            surface: import('../core/topicProfileWriteSurface.js').TopicProfileWriteSurface;
            confirmSlots: import('../core/topicProfileIngress.js').ProfileConfirmSlots;
            /** §8 orchestrator — model-swap route runExclusive wrap + ingress
             *  confirm surfaces. Null until the server wiring constructs it. */
            orchestrator?: import('../core/TopicProfileOrchestrator.js').TopicProfileOrchestrator | null;
            /** §5.3 transfer carrier — pendingTransferPull staleness on the read
             *  surface + the /pool/transfer acquire seam. Null on single-machine. */
            carrier?: import('../core/TopicProfileTransferCarrier.js').TopicProfileTransferCarrier | null;
        } | null;
        sessionRefresh?: import('../core/SessionRefresh.js').SessionRefresh;
        autonomyManager?: import('../core/AutonomyProfileManager.js').AutonomyProfileManager;
        trustElevationTracker?: import('../core/TrustElevationTracker.js').TrustElevationTracker;
        autonomousEvolution?: import('../core/AutonomousEvolution.js').AutonomousEvolution;
        coordinator?: MultiMachineCoordinator;
        /** Multi-Machine Session Pool registry (§L2) — live MachineCapacity view behind GET /pool. */
        machinePoolRegistry?: import('../core/MachinePoolRegistry.js').MachinePoolRegistry;
        /** Durable Inbound Message Queue engine getter (late-bound; null = dark). */
        getInboundQueue?: () => import('../core/QueueDrainLoop.js').QueueDrainLoop | null;
        /** MeshRpc dispatcher (§L0) — receive side behind POST /mesh/rpc. */
        meshRpcDispatcher?: import('../core/MeshRpc.js').MeshRpcDispatcher;
        /** Working-set pull coordinator (WORKING-SET-HANDOFF §3.3) — behind
         *  POST /coherence/fetch-working-set. Absent while the layer is dark. */
        workingSetPullCoordinator?: import('../core/WorkingSetPullCoordinator.js').WorkingSetPullCoordinator;
        /** Commitments-coherence replica store (COMMITMENTS-COHERENCE §3.2) —
         *  merged GET /commitments?scope=mesh. Absent while dark. */
        commitmentReplicaStore?: import('../core/CommitmentsSync.js').CommitmentReplicaStore;
        /** Preferences-pool replica store (MULTI-MACHINE-SEAMLESSNESS §WS2.1) —
         *  union read folds these into GET /preferences/session-context. Absent while dark. */
        preferenceReplicaStore?: import('../core/PreferencesSync.js').PreferenceReplicaStore;
        /** WS2.1 SEND-SIDE: the journal-backed replicated-record emitter, forwarded to the
         *  RouteContext so the correction-loop's PreferencesManager can attach + emit. Absent while dark. */
        replicatedRecordEmitter?: import('../core/ReplicatedRecordEmitter.js').ReplicatedRecordEmitter;
        /** Replicated-store conflict ledger (replicated-store-foundation §7.2/§7.3).
         *  Backs GET /state/conflicts + POST /state/resolve-conflict. Absent while dark. */
        conflictStore?: import('../core/ConflictStore.js').ConflictStore;
        /** Rollback-unmerge engine (§7.4). Absent while dark. */
        rollbackUnmerge?: import('../core/RollbackUnmerge.js').RollbackUnmerge;
        /** Durable un-merged-origins registry (§7.4). Absent while dark. */
        droppedOriginRegistry?: import('../core/RollbackUnmerge.js').DroppedOriginRegistry;
        /** WS2.1 union reader for the `preferences` store (§7.2). The bypass-proof
         *  funnel GET /preferences/session-context reads the no-clobber union through
         *  when stateSync.preferences.enabled. Absent while dark. */
        preferencesUnionReader?: import('../core/ReplicatedStoreReader.js').ReplicatedStoreReader;
        /** P1.5b owner-routed mutation forward (§3.4). Absent while dark. */
        forwardCommitmentMutate?: (ownerMachineId: string, payload: import('../core/CommitmentMutation.js').CommitmentMutatePayload) => Promise<{
            kind: 'verdict';
            outcome: import('../core/CommitmentMutation.js').MutateOutcome;
        } | {
            kind: 'queued';
            reason: string;
        }>;
        /** Per-session ownership registry (§L3). */
        sessionOwnershipRegistry?: import('../core/SessionOwnershipRegistry.js').SessionOwnershipRegistry;
        /** Topic placement pin store (§L4) — backs GET /pool/placement + POST /pool/transfer. */
        topicPinStore?: import('../core/TopicPlacementPinStore.js').TopicPlacementPinStore;
        /** Pool Dashboard Streaming (§2.3) — shared single-use ticket store the
         *  WebSocketManager's /pool-stream upgrade consumes. */
        streamTicketStore?: import('./StreamTicketStore.js').StreamTicketStore;
        /** Pool Dashboard Streaming (§2.3) — may a PEER send input to a local
         *  session over /pool-stream? Default false (keystroke-forwarding is a
         *  lateral-movement vector). */
        poolStreamAllowRemoteInput?: boolean;
        /** Pool Dashboard Streaming requesting side (§2.2) — opens upstream
         *  /pool-stream links to peers so a remote-session subscribe streams. */
        poolStreamConnector?: import('./WebSocketManager.js').PoolStreamConnector;
        /** Cross-machine secret-sync (spec Phase 4) — backs GET /secrets/sync-status + POST /secrets/sync-now. */
        secretSync?: import('../core/SecretSync.js').SecretSyncHandle;
        /** This machine's mesh id. */
        meshSelfId?: string;
        /** Resolve the lease-holder's base URL when this machine is not the holder (else null). */
        resolveRouterUrl?: () => string | null;
        /** WS1.2 sender leg: order the topic's owner (local or remote) to drain for a transfer. */
        sendDrain?: (ownerMachineId: string, sessionKey: string, target: string, ownershipEpoch: number) => Promise<{
            ok: boolean;
            status?: string;
            reason?: string;
            noHandler?: boolean;
            runSuspended?: boolean;
        }>;
        /** Every other active machine with a known URL — backs GET /sessions?scope=pool. */
        resolvePeerUrls?: () => Array<{
            machineId: string;
            url: string;
        }>;
        /** Guard runtime registry (GUARD-POSTURE-ENDPOINT-SPEC §2.1) — behind GET /guards. */
        guardRegistry?: import('../monitoring/GuardRegistry.js').GuardRegistry;
        /** EVERY registered, non-revoked machine (URL or not) — the /guards?scope=pool accounting boundary. */
        listPoolMachines?: () => Array<{
            machineId: string;
            nickname?: string;
            lastKnownUrl?: string | null;
        }>;
        /** WS4.4 "links that survive machine boundaries" — fronting proxy + holder verification handle (MULTI-MACHINE-SEAMLESSNESS-SPEC §WS4.4). */
        poolLink?: import('./routes.js').RouteContext['poolLink'];
        /** WS4.4(f) global pool-cache unification — the ONE shared per-peer poll cache pool-scope surfaces fan out through (MULTI-MACHINE-SEAMLESSNESS-SPEC §WS4.4 clause (f)). */
        poolPollCache?: import('./PoolPollCache.js').PoolPollCache | null;
        /** Signed rollout-stage E2E result store (§Rollout). */
        sessionPoolE2EResultStore?: import('../core/SessionPoolE2EResultStore.js').SessionPoolE2EResultStore;
        localSigningKeyPem?: string;
        /** WS5.2 R4a — operator/issuer side: deliver an R4a-signed account-follow-me mandate to a REMOTE
         *  target over the signed mesh. Injected from server.ts (where the mesh client + peer-URL
         *  resolution live). Absent ⇒ this machine cannot deliver (single-machine / no mesh). */
        deliverMandateToMachine?: (args: {
            targetMachineId: string;
            portable: import('../coordination/AccountFollowMeMandateBridge.js').PortableMandate;
        }) => Promise<{
            ok: boolean;
            status: number;
            reason?: string;
        }>;
        /** Lease wire transport — receives peer lease broadcasts at /api/lease (spec §6). */
        leaseTransport?: {
            recordObserved: (lease: any) => void;
        };
        /**
         * Serve this machine's current effective-view signed lease for an active PULL
         * (POST /api/lease/pull, Cross-Machine Coherence). Returns the signed lease (may
         * name a third machine — re-served) or null. Wired to LeaseCoordinator.currentLease().
         */
        onLeasePullRequest?: () => unknown | null;
        /**
         * Handoff wire transport — the point-to-point ack/yield channel for the
         * planned handoff (spec §8 G3d/G3e). The /api/handoff/ack route delivers the
         * incoming machine's verified echo via recordAck (resolves the outgoing's
         * awaitAck); /api/handoff/yield delivers the explicit yield via recordYield
         * (fires the incoming's registered yield handler → lease CAS). Absent → both
         * routes 503 (honest not-wired), never a silent ok.
         */
        handoffWireTransport?: {
            recordAck: (ack: any) => void;
            recordYield: () => void;
        };
        /**
         * Incoming-side begin handler — invoked when a peer POSTs /api/handoff/begin
         * with its flush manifest (spec §8 G3d). server.ts binds this to store the
         * manifest and drive the HandoffReceiver's onBeginHandoff (build + send ack).
         * Absent → the begin route 503s.
         */
        onHandoffBegin?: (manifest: unknown, fromMachineId: string) => void;
        /**
         * Outgoing-side planned-handoff trigger (spec §8 G3e). server.ts binds this
         * to handoffSentinelWiring.initiate — the operator/test "hand off now" entry
         * point behind POST /handoff/initiate. Absent → the route 503s (not wired).
         */
        onHandoffInitiate?: () => Promise<'handed-off' | 'aborted-stay-awake' | 'failed'>;
        /**
         * Race-guard read for the planned handoff (HandoffSentinel.inProgress). The
         * reaper/scheduler can consult it so they do not act mid-handoff; also
         * surfaced at GET /handoff/status.
         */
        handoffInProgress?: () => boolean;
        /**
         * Exactly-once ingress ledger (spec §8 G3a) — present ONLY when
         * multiMachine.exactlyOnceIngress is enabled (server.ts constructs it).
         * Absent → the inbound/outbound message path behaves exactly as before.
         */
        messageLedger?: import('../messaging/MessageProcessingLedger.js').MessageProcessingLedger;
        /** Per-topic current-inbound dedupeKey map; paired with messageLedger. */
        currentInboundByTopic?: Map<string, string>;
        /**
         * Cross-machine reply-marker propagation (spec §8 G3a). The outbound reply
         * path broadcasts a marker to standby peers when a reply commits; present only
         * when the exactly-once ledger is wired. Absent → no cross-machine propagation.
         */
        replyMarkerTransport?: import('../core/ReplyMarkerTransport.js').ReplyMarkerTransport;
        /** Apply a peer's reply marker (→ machineRoutes /api/message-marker → ledger.applyRemoteReplyMarker). */
        onReplyMarker?: (marker: unknown, fromMachineId: string) => void;
        /**
         * Live-tail receiver — decrypts + applies a peer's encrypted live-tail flush
         * received at /api/live-tail (spec §8 G3b/c). Throws on decrypt/verify failure.
         */
        liveTailReceiver?: (flush: {
            topic: string;
            seq: number;
            enc: unknown;
            redactionVersion?: number;
        }, fromMachineId: string) => {
            applied: boolean;
            reason: string;
        } | void;
        whatsapp?: import('../messaging/WhatsAppAdapter.js').WhatsAppAdapter;
        slack?: import('../messaging/slack/SlackAdapter.js').SlackAdapter;
        imessage?: import('../messaging/imessage/IMessageAdapter.js').IMessageAdapter;
        whatsappBusinessBackend?: import('../messaging/backends/BusinessApiBackend.js').BusinessApiBackend;
        messageBridge?: import('../messaging/shared/MessageBridge.js').MessageBridge;
        hookEventReceiver?: import('../monitoring/HookEventReceiver.js').HookEventReceiver;
        worktreeMonitor?: import('../monitoring/WorktreeMonitor.js').WorktreeMonitor;
        subagentTracker?: import('../monitoring/SubagentTracker.js').SubagentTracker;
        instructionsVerifier?: import('../monitoring/InstructionsVerifier.js').InstructionsVerifier;
        threadlineRouter?: import('../threadline/ThreadlineRouter.js').ThreadlineRouter;
        /** Threadline Phase 1 keystone — Conversation store + warrants-a-reply gate,
         *  so the local co-located inbound path gates like the relay funnel. */
        conversationStore?: import('../threadline/ConversationStore.js').ConversationStore;
        /** Robustness Phase 2 (D-A/D-B) — the canonical per-thread log + append funnel. */
        threadLog?: import('../threadline/ThreadLog.js').ThreadLog;
        threadMessageRecorder?: import('../threadline/recordThreadMessage.js').ThreadMessageRecorder;
        warrantsReplyGate?: import('../threadline/WarrantsReplyGate.js').WarrantsReplyGate;
        collaborationSurfacer?: import('../threadline/CollaborationSurfacer.js').CollaborationSurfacer;
        /** ThreadResumeMap — for topic-linkage outbound capture on /threadline/relay-send.
         *  Per THREAD-TOPIC-LINKAGE-SPEC.md. */
        threadResumeMap?: import('../threadline/ThreadResumeMap.js').ThreadResumeMap;
        /** Topic-linkage handler that ties threadline sends to Telegram topic sessions. */
        topicLinkageHandler?: import('../threadline/TopicLinkageHandler.js').TopicLinkageHandler;
        handshakeManager?: import('../threadline/HandshakeManager.js').HandshakeManager;
        threadlineRelayClient?: import('../threadline/client/ThreadlineClient.js').ThreadlineClient;
        threadlineReplyWaiters?: Map<string, {
            resolve: (reply: string) => void;
            threadId: string;
            senderAgent: string;
            timer: ReturnType<typeof setTimeout>;
        }>;
        listenerManager?: import('../threadline/ListenerSessionManager.js').ListenerSessionManager;
        a2aDeliveryTracker?: import('../threadline/A2ADeliveryTracker.js').A2ADeliveryTracker;
        responseReviewGate?: import('../core/CoherenceGate.js').CoherenceGate;
        messagingToneGate?: import('../core/MessagingToneGate.js').MessagingToneGate;
        outboundDedupGate?: import('../core/OutboundDedupGate.js').OutboundDedupGate;
        telemetryHeartbeat?: import('../monitoring/TelemetryHeartbeat.js').TelemetryHeartbeat;
        pasteManager?: import('../paste/PasteManager.js').PasteManager;
        soulManager?: import('../core/SoulManager.js').SoulManager;
        featureRegistry?: import('../core/FeatureRegistry.js').FeatureRegistry;
        discoveryEvaluator?: import('../core/DiscoveryEvaluator.js').DiscoveryEvaluator;
        completionEvaluator?: import('../core/CompletionEvaluator.js').CompletionEvaluator;
        /** Live-user-channel-proof completion gate (§4) — refuses "done" without a verified artifact. */
        liveTestGate?: import('../core/LiveTestGate.js').LiveTestGate;
        liveTestGateMode?: import('../core/LiveTestGate.js').LiveTestGateMode;
        /** Live-user-channel-proof CAPSTONE runner wiring (§6/§7.5) — dev-gated + dark.
         *  A factory (not a pre-bound runner) so the route can wrap the request-built
         *  RealChannelDriver, sharing the gate's artifact store. Undefined when dark/unwired. */
        liveTestRunnerCtx?: LiveTestRunnerWiring;
        unifiedTrust?: import('../threadline/UnifiedTrustWiring.js').UnifiedTrustSystem;
        liveConfig?: {
            set(path: string, value: unknown): void;
            get?<T>(path: string, def: T): T;
        };
        /** Shared proxy coordinator (PresenceProxy ↔ PromiseBeacon ↔ /build heartbeat). */
        proxyCoordinator?: import('../monitoring/ProxyCoordinator.js').ProxyCoordinator;
        /** Integrated-Being shared-state ledger (v1). Null/undefined when disabled. */
        sharedStateLedger?: import('../core/SharedStateLedger.js').SharedStateLedger;
        /** Integrated-Being LedgerSessionRegistry (v2). Null/undefined when v2Enabled=false. */
        ledgerSessionRegistry?: import('../core/LedgerSessionRegistry.js').LedgerSessionRegistry;
        /** Worktree manager — parallel-dev isolation (PARALLEL-DEV-ISOLATION-SPEC.md). */
        worktreeManager?: WorktreeManager;
        /** Layer 1 of the Topic Intent Layer — per-topic confidence tracker. Null/undefined when disabled. */
        topicIntentStore?: TopicIntentStore;
        /** Layer 3 of the Topic Intent Layer — pre-send classifier. Same instance is used
         *  by the HTTP route AND the in-process outbound-gate caller in routes.ts. */
        topicIntentArcCheck?: import('../core/TopicIntentArcCheck.js').ArcCheck | null;
        /** Shared intelligence provider (subscription/REPL-pool) for the standards-conformance gate. */
        intelligence?: import('../core/types.js').IntelligenceProvider | null;
        /** Usher signal store (rung 4) — the read-only pull surface for re-surface signals. */
        usherSignalStore?: import('../core/UsherSignalStore.js').UsherSignalStore | null;
        /** OIDC verification function for the GH-check endpoint (injected for testability). */
        oidcVerify?: (token: string) => Promise<{
            repository: string;
            workflow_ref: string;
            ref: string;
        }>;
        /** Enrolled GitHub repos allowed to call the GH-check endpoint. */
        oidcEnrolledRepos?: Array<{
            owner: string;
            repo: string;
        }>;
        /** UnjustifiedStopGate authority (PR3 — context-death spec). */
        unjustifiedStopGate?: import('../core/UnjustifiedStopGate.js').UnjustifiedStopGate;
        /** Stop-gate SQLite persistence (PR3). */
        stopGateDb?: import('../core/StopGateDb.js').StopGateDb;
        /** notify-on-stop Layer B — surfaces genuinely-stuck unattended stops. */
        stopNotifier?: import('../monitoring/StopNotifier.js').StopNotifier | null;
        /** Initiative tracker — persisted record of multi-phase long-running work. */
        initiativeTracker?: import('../core/InitiativeTracker.js').InitiativeTracker;
        /** Project-scope round runner (Phase 1b PR 3). */
        projectRoundRunner?: import('../core/ProjectRoundRunner.js').ProjectRoundRunner;
        /** Project drift checker (Phase 1b connect-the-dots). Optional —
         *  when omitted, POST /projects/:id/drift-check returns 503. */
        projectDriftChecker?: import('../core/ProjectDriftChecker.js').ProjectDriftChecker;
        /** Multi-machine heartbeat + claim-ownership support (Phase 1b PR 4). */
        machineHeartbeat?: {
            api: import('../core/MachineHeartbeat.js').MachineHeartbeat;
            config: {
                machineId: string;
            };
        };
        /** SessionReaper — pressure-aware idle-session reaper (off/dry-run by
         *  default). Powers GET /sessions/reaper. */
        sessionReaper?: import('../monitoring/SessionReaper.js').SessionReaper;
        /** AgentWorktreeReaper — reclaims stale CLI worktrees. Powers
         *  GET /worktrees/agent-reaper. */
        agentWorktreeReaper?: import('../monitoring/AgentWorktreeReaper.js').AgentWorktreeReaper;
        /** OrphanedWorkSentinel — the silent-uncommitted-death backstop. Powers
         *  GET /orphaned-work. */
        orphanedWorkSentinel?: import('../monitoring/OrphanedWorkSentinel.js').OrphanedWorkSentinel;
        /** McpProcessReaper — reclaims leaked MCP-server children of dead/stale
         *  sessions. Powers GET /processes/mcp-reaper. */
        mcpProcessReaper?: import('../monitoring/McpProcessReaper.js').McpProcessReaper;
        /** GeminiLoopRunner — multi-turn gemini loop-driver (need-gem-002). Powers
         *  POST + GET /gemini-loop/runs. */
        geminiLoopRunner?: import('../monitoring/GeminiLoopRunner.js').GeminiLoopRunner | null;
        /** SleepController — agent hard-sleep decision (Stage B). Powers GET /sleep. */
        sleepController?: import('../monitoring/SleepController.js').SleepController;
        /** AgentActivityState — shared idle signal bumped at the inbound chokepoint. */
        agentActivityState?: import('../monitoring/AgentActivityState.js').AgentActivityState;
        /** ReapLog — durable audit of every reap + skipped-reap (UNIFIED-SESSION-LIFECYCLE
         *  §P4). Powers GET /sessions/reap-log. */
        reapLog?: import('../monitoring/ReapLog.js').ReapLog;
        /** ResumeQueue + drainer (reap-notify spec R2.10) — /sessions/resume-queue*. */
        resumeQueue?: import('../monitoring/ResumeQueue.js').ResumeQueue | null;
        resumeDrainer?: import('../monitoring/ResumeQueueDrainer.js').ResumeQueueDrainer | null;
        autonomousLivenessReconciler?: import('../monitoring/AutonomousLivenessReconciler.js').AutonomousLivenessReconciler | null;
        /** Records operator stop instructions for the drainer's R2.6 validation. */
        operatorStopRecorder?: (topicId: number | null) => void;
        /** SleepWakeDetector — timer-drift sleep detection with CPU-starvation guard.
         *  Powers GET /monitoring/sleep-wake (wake + suppression telemetry). */
        sleepWakeDetector?: import('../core/SleepWakeDetector.js').SleepWakeDetector;
        /** Threadline → Telegram bridge config — toggles + allow/deny list. */
        telegramBridgeConfig?: import('../threadline/TelegramBridgeConfig.js').TelegramBridgeConfig;
        /** Threadline → Telegram bridge — relay-only mirror of threadline messages. */
        telegramBridge?: import('../threadline/TelegramBridge.js').TelegramBridge;
        /** Threadline observability — read-only views over inbox/outbox/bindings. */
        threadlineObservability?: import('../threadline/ThreadlineObservability.js').ThreadlineObservability;
        /** CMT-567: shared deps for the "open this" LLM topic-name + summary brief. */
        briefDeps?: import('../threadline/openConversationBrief.js').BriefDeps;
        /** TaskFlow registry — durable multi-step job records (OpenClaw import). */
        taskFlowRegistry?: import('../tasks/TaskFlowRegistry.js').TaskFlowRegistry;
        /** ThreadlineFlowBridge — resumes flows on cross-agent-callback inbound. */
        threadlineFlowBridge?: import('../tasks/ThreadlineFlowBridge.js').ThreadlineFlowBridge;
    });
    /**
     * Resolve the dashboard directory.
     * In dev: ../../../dashboard (relative to src/server/)
     * In dist (published): ../../dashboard (relative to dist/server/)
     */
    private resolveDashboardDir;
    /**
     * Wire the mentor-onboarding runner (§19.4) from real services. Ships DORMANT:
     * the config defaults to mentor.enabled=false / mode='off', so tick() returns
     * {ran:false, reason:'disabled'} in production until a human flips it via the
     * graduated-rollout track. The live spawn/forensics paths are real code, gated
     * behind that flag and validated via test-as-self before promotion.
     */
    /** Find the N most recently-modified rollout .jsonl files under a codex sessions
     *  dir (nested year/month/day). Best-effort; returns [] on any error. */
    private findRecentRolloutFiles;
    /**
     * Extract a completed mentee session's FINAL assistant message from its
     * persisted transcript (clean prose), rather than the racy tmux-pane read.
     * Returns null when no transcript reply is found — the caller then keeps the
     * tmux-capture fallback.
     *
     * - Codex sessions: the newest rollout JSONL under $CODEX_HOME/sessions that
     *   was written at/after the spawn → `task_complete.last_agent_message`.
     * - Claude sessions: the session's JSONL transcript (by claudeSessionId) →
     *   the last assistant text block.
     */
    private extractMenteeReplyFromTranscript;
    /**
     * Lazily construct + cache the mentor-bot TelegramAdapter for the given token. Uses
     * PR 2a's multi-instance support (subDir + suppressLifelineAutoCreate) so the second
     * bot can't clobber the primary bot's state files OR auto-create a second Lifeline
     * topic. Reconfiguration (token change) tears down the old adapter first.
     * Returns null on construction failure (logged) — caller treats as "no delivery."
     */
    private getOrCreateMentorBot;
    /** Lazily construct + cache the a2a audit ledger. Paths default under stateDir. */
    private getOrCreateA2aLedger;
    /** Lazily construct + cache the processed-id store (idempotency for inbound replies). */
    private getOrCreateA2aProcessedIds;
    /** Lazily construct + cache the outstanding-prompt tracker (anti-ping-pong). */
    private getOrCreateMentorOutstanding;
    /**
     * Install the mentor-reply recipient hook on the mentor-bot adapter. Called from
     * getOrCreateMentorBot once the adapter is up. The hook routes role=`mentor-reply`
     * from Codey to a handler that (1) clears the outstanding-prompt entry by `corr`
     * (so the next mentor tick can send again), and (2) persists the reply to a
     * jsonl file Stage-B forensics reads. This is the capability-handle invariant from
     * the spec: the reply-ingestion path CANNOT call spawnStageA / deliverToMentee /
     * scheduler / Threadline — it only writes the reply + clears tracking.
     */
    private installMentorReceiverHook;
    /**
     * Install the agent-message hook on the PRIMARY TelegramAdapter for mentee
     * agents. Mirror of `installMentorReceiverHook` (which runs on the mentor BOT
     * adapter to catch mentor-REPLIES); this runs on the primary adapter where
     * the agent normally polls for user messages, and catches inbound
     * mentor PROMPTS from allowlisted mentor agents
     * (MENTOR-LIVE-READINESS-SPEC §Recipient side).
     *
     * Hook is installed iff `config.mentee.enabled === true` AND all of
     * `localAgentName`, `knownMentors`, `replyChatId`, `replyTopicId` are set.
     * Each missing piece logs a one-line skip and bails — no partial wiring.
     * The wiring stays dark by default (`enabled: false`).
     *
     * The role-handler:
     *   1. Spawns a mentee session with `msg.body` as the prompt (the agent's
     *      default tool grant — not the Stage-A empty-tools constraint).
     *   2. Bounded-waits up to `sessionTimeoutMs` (default 5 min). On timeout
     *      the session is killed and an empty reply is logged — no partial
     *      transcript is sent.
     *   3. Captures the tmux pane transcript as the reply.
     *   4. Sends the reply back via `sendAgentMessage` with
     *      `role='mentor-reply'` and `corr=msg.corr || msg.id` so the
     *      mentor's `OutstandingPromptTracker` can clear by correlation.
     *
     * Reply-out happens in the handler's orchestrator section (NOT through a
     * capability passed to the handler) per the spec's capability-handle
     * anti-loop discipline: handlers are capture-only, and the only outbound
     * role they may emit is `mentor-reply` (declared in `allowedRoles`).
     */
    private installMentorMessageHook;
    /**
     * Deliver an a2a message to another agent. Same-machine peers (registered in
     * AgentRegistry) receive it via HTTP POST to their `/a2a/inbox` endpoint —
     * the canonical transport because Telegram structurally blocks bot-to-bot
     * delivery. Cross-machine peers fall back to the Telegram bot path (preserved
     * but currently unreachable due to the same block; tracked follow-up).
     *
     * Used by BOTH directions: the mentor's `deliverToMentee` (role=mentor) and
     * the mentee's reply (role=mentor-reply). Returns true iff delivered.
     */
    private deliverA2aMessage;
    /** Snapshot of mentee config for the receiver-wiring installer. */
    private getMenteeConfigSnapshot;
    /**
     * This agent's own primary Telegram bot id (the numeric prefix of its
     * messaging bot token), or undefined if no Telegram messaging is configured.
     * Used as the a2a `senderBotId` so a recipient's allowlist check
     * (knownAgents[from].botId === senderBotId) passes — the sender must
     * identify with its OWN bot id.
     */
    private ownPrimaryBotId;
    /** Snapshot of mentor config for use outside the runner's getConfig closure. */
    private getMentorConfigSnapshot;
    /**
     * Read the mentee's recent replies from `<stateDir>/mentor-replies.jsonl` for
     * the Stage-A conversation surface. Best-effort: a missing/garbled file yields
     * an empty list (the surface degrades to "(no prior conversation)" — never
     * throws into the tick). Only the mentee's own replies are user-visible
     * conversation, so this is two-hats-safe. `ts` is coerced from string|number.
     */
    private readRecentMenteeReplies;
    /**
     * Read the mentor's own sent prompts from `<stateDir>/mentor-sent.jsonl` for
     * the Stage-A conversation surface. Best-effort like replies: missing or
     * garbled logs degrade to no mentor-side history rather than breaking ticks.
     */
    private readRecentMentorSent;
    private appendMentorSent;
    private buildMentorRunner;
    /**
     * Start the HTTP server.
     */
    start(): Promise<void>;
    /**
     * Spin up the Layer 3 DeliveryFailureSentinel. Opens the per-agent
     * pending-relay SQLite store (creating it lazily if needed), wires
     * the sentinel into the WebSocket event stream so `delivery_failed`
     * events drive recovery in <1s, and arms the watchdog tick.
     *
     * Failures here are isolated — the sentinel is opt-in default-OFF
     * infrastructure, not a critical-path dependency. Any error here is
     * logged and the rest of the server continues running.
     */
    private startDeliverySentinel;
    /**
     * Stop the HTTP server gracefully.
     * Closes keep-alive connections after a timeout to prevent hanging.
     */
    stop(): Promise<void>;
    /**
     * Expose the Express app for testing with supertest.
     */
    getApp(): Express;
    /**
     * WS5.2 R4a — TARGET-side acceptance of a cross-machine-delivered account-follow-me mandate (the
     * brains behind the `account-follow-me-mandate-deliver` mesh handler, which is wired in server.ts
     * where the peer-key resolver lives). `sender` MUST be the mesh-AUTHENTICATED envelope sender;
     * `operatorPublicKeyPem` is that sender's REGISTERED Ed25519 key (resolved by the caller from the
     * same registered-identity store verifyEnvelope used) — never a key from the payload. FAIL CLOSED:
     * feature dark / no store / signature-or-bounds failure → refuse + persist nothing.
     */
    acceptDeliveredMandateCommand(sender: string, portable: import('../coordination/AccountFollowMeMandateBridge.js').PortableMandate | undefined | null, operatorPublicKeyPem: string | null): {
        accepted: boolean;
        reason?: string;
        mandateId?: string;
    };
    /** Wiring-integrity accessor: the ParallelWorkSentinel when constructed (enabled), else null. */
    getParallelWorkSentinel(): ParallelWorkSentinel | null;
    /**
     * Wiring-integrity accessor: the PRODUCTION Self-Unblock checklist (real probe
     * providers + durable run store) when the self-unblock sub-feature is on, else
     * null. The PRODUCER surface POST /blockers/self-unblock-run runs this.
     */
    getSelfUnblockChecklist(): SelfUnblockChecklist | null;
    /**
     * The topic-operator store (Know Your Principal #898). Exposed so the inbound
     * routing seam (`wireTelegramRouting`, increment 2e) binds the operator on the
     * POLLING ingress path with the SAME instance the routes use — the store caches
     * its map in memory, so constructing a second instance on the same file would
     * lose updates between the two caches.
     */
    getTopicOperatorStore(): TopicOperatorStore | null;
    /**
     * TOPIC-PROFILE-SPEC §9 — the escalation governor, exposed for the
     * orchestrator's escalation port (server.ts wiring late-binds through the
     * AgentServer ref so a profile-triggered kill releases the topic's ultra
     * lease). Null when model-tier escalation failed to initialize.
     */
    getEscalationGovernor(): EscalationGovernor | null;
    /**
     * WS5.3 (escalation-rides-topic) — the ephemeral per-topic escalation-hint
     * carrier, exposed so the server.ts wiring can (a) let the topic-profile
     * pull serve-handler PEEK the hint to carry it across the acquire pull, and
     * (b) drive the destination CONSUME + re-admit when the resumed session
     * spawns. Null when model-tier escalation failed to initialize.
     */
    getEscalationHintStore(): EscalationHintStore | null;
    /**
     * TOPIC-PROFILE-SPEC §7 — the FABLE in-flight swap engine, exposed for the
     * orchestrator's inFlightSwap port (the §7 in-flight row delegates to the
     * SAME ModelSwapService the /sessions/:name/model-swap route uses, so the
     * §10.2 closed-enum + cost-guard + idle disciplines apply identically).
     */
    getModelTierSwap(): ModelSwapService | null;
}
//# sourceMappingURL=AgentServer.d.ts.map