/**
 * mama start command — thin orchestrator.
 *
 * This file contains two functions:
 *   - startCommand()   — CLI entry point (config load, foreground/daemon decision)
 *   - runAgentLoop()   — linear orchestrator that calls all init functions in order
 *
 * All heavy lifting is delegated to modules in ../runtime/.
 */
import { loadConfig } from '../config/config-manager.js';
import type { AgentContext, GatewayToolExecutionContext, PrincipalRepository } from '../../agent/types.js';
import type { ExecutionResult } from '../../agent/code-act/types.js';
import type { CodeActExecutionContext, CodeActResult } from '../../api/graph-api-types.js';
import { type PrincipalResolver } from '../runtime/gateway-init.js';
import { type PrivateConnectorPolicy } from '../../connectors/private-connector-policy.js';
import { type MemoryScopeRef } from '../../memory/scope-context.js';
import { type AgentPersonaConfig } from '../config/types.js';
import type { DBManagerAdapter as DatabaseAdapter } from '@jungjaehoon/mama-core';
import { type WorkOrderKind } from '../../operator/task-ledger.js';
import { type OwnerBackfillRegistry } from '../runtime/owner-backfill.js';
type RuntimeBackend = 'claude' | 'codex' | 'cline';
type CorePrincipalRegistry = OwnerBackfillRegistry & PrincipalRepository;
export declare function createCorePrincipalRegistry(adapter: DatabaseAdapter): CorePrincipalRegistry;
export declare function createCorePrincipalResolver(adapter: DatabaseAdapter): PrincipalResolver;
export declare function requireRuntimeBackend(value: unknown): RuntimeBackend;
export declare function assertConductorBackendSupported(enabled: boolean, backend: RuntimeBackend): void;
export declare function serializeCodeActExecutionResult(result: ExecutionResult, toolCalls: {
    name: string;
    input: Record<string, unknown>;
}[], hostToolExecutions?: Array<{
    name: string;
    success: boolean;
    code?: string;
}>): CodeActResult & {
    toolCalls: {
        name: string;
        input: Record<string, unknown>;
    }[];
};
export declare function deriveCodeActToolPolicy(requestContext: CodeActExecutionContext | undefined, agentConfig: Omit<AgentPersonaConfig, 'id'> | undefined): {
    allowedTools?: string[];
    blockedTools?: string[];
};
export declare function resolveCodeActAgentPolicy(requestContext: CodeActExecutionContext | undefined, agents: Record<string, Omit<AgentPersonaConfig, 'id'>> | undefined, defaultAgentId: string): {
    agentId: string;
    agentConfig?: Omit<AgentPersonaConfig, 'id'>;
    policy?: {
        allowedTools?: string[];
        blockedTools?: string[];
    };
    error?: string;
};
export declare function resolveCodeActRawConnectors(enabledConnectorNames: readonly string[] | undefined): string[];
/**
 * The connector and channel a temporal task is bound to, as plain values.
 *
 * The workorder payload carries only HASHED source identifiers (they are compared, never
 * read), so the binding has to come from the owner task row. Split on the FIRST colon:
 * `source_channel` is `<connector>:<channelId>` and channel ids contain colons of their own.
 *
 * Returns null when the task names no channel - which is not a failure, it is a task whose
 * reconcile may rest on no raw evidence at all.
 */
/**
 * The scope a workorder envelope carries.
 *
 * Extracted so the binding can be asserted directly. Composed inline, the only way to test
 * it was to re-compose it in the test - which tests the copy, and a copy of a scope
 * construction is how this subsystem's authority drifts from what it claims.
 */
/**
 * What the scheduled full report is INSTRUCTED to gather with.
 *
 * Exported so a test can hold it against the lane's tool grant. Every defect this session
 * found was a wiring defect - a tool granted and never instructed, a lane wired zero times,
 * a binder that never bound - and all of them live in this file and its neighbour, the two
 * directories the suite covers at a third. An instruction list that cannot be read by a
 * test is one nobody can check against the grant it depends on.
 */
export declare function buildFullReportGatherLines({ lastSuccessIso, }: {
    lastSuccessIso: string | null;
}): string[];
/**
 * The batch a work order carries, as the run's cause.
 *
 * Exported because it was an inline closure and therefore untestable, while being the ONE
 * hop that carries this branch's whole claim: the system knew the batch before the run
 * began, so the agent never has to restate it. Review pointed out that `causeEventIds`
 * appeared in exactly two test files and both called the ledger directly - a rename or a
 * payload-shape drift here would have returned attribution to 32% with the suite green.
 *
 * Only per-channel reconcile work orders carry `eventIds`; `board:full`, wiki and
 * memory-curation do not, and get an empty batch rather than an invented one.
 */
export declare function causeEventIdsFromPayload(payload: unknown): string[];
export declare function workOrderEnvelopeScope(input: {
    workKind: WorkOrderKind;
    projectId: string;
    laneConnectors: string[];
    temporalBinding: {
        connector: string;
        channel: string;
    } | null;
    privateConnectorPolicy: PrivateConnectorPolicy;
}): {
    project_refs: Array<{
        kind: 'project';
        id: string;
    }>;
    raw_connectors: string[];
    memory_scopes: MemoryScopeRef[];
    allowed_destinations: never[];
};
export declare function temporalTaskBinding(ledger: {
    getById: (id: number) => {
        sourceChannel?: string | null;
    } | null;
}, taskId: number): {
    connector: string;
    channel: string;
} | null;
export declare const WORKORDER_TOOL_POLICIES: {
    readonly board: {
        readonly roleName: "workorder-board";
        readonly allowedTools: readonly ["agent_notices", "changes_read", "context_compile", "contract_no_update", "mama_search", "report_publish", "task_create", "task_external_bind", "task_lifecycle_reconcile", "task_list", "task_update", "trello_card", "trello_kanban", "trello_search"];
    };
    readonly wiki: {
        readonly roleName: "workorder-wiki";
        readonly allowedTools: readonly ["agent_notices", "context_compile", "mama_search", "obsidian", "wiki_publish"];
    };
    readonly 'memory-curation': {
        readonly roleName: "workorder-memory-curation";
        readonly allowedTools: readonly ["agent_notices", "mama_save", "mama_search"];
    };
    readonly temporal: {
        readonly roleName: "workorder-temporal";
        readonly allowedTools: readonly ["agent_notices", "context_compile", "schedule_upcoming", "task_list", "task_temporal_reconcile"];
    };
};
/**
 * Gateway tools the scheduled operator report must be able to EXECUTE.
 *
 * The report lane is a short-lived operator job like the Stage-2 workers, so its permissions
 * are built in rather than derived from optional persona config. Membership is dictated by
 * what the report is actually instructed to call: report-run.ts GATHER_TOOLS (the audit that
 * decides whether a full report has task-board substance), the fullReportSelfGather lines,
 * the board_publish lines, and the single mama_save the report may make.
 *
 * Its envelope grants no destinations, so no send tool belongs here, and no task-mutation
 * tool either: the report observes, the board workorder maintains.
 *
 * trello_kanban is the ONE whole-board live read. Without it the report could only restate the
 * native ledger, which is a derived store the board workorder is forbidden to sync from Trello -
 * so a card that moved days ago still reported as "no completion signal" (live 2026-07-28).
 * Reading it is scoped by the envelope now that direct connector readers are mapped in
 * envelope/tool-connector-scope.ts; without that mapping this entry alone would have granted
 * unscoped access.
 */
export declare const OPERATOR_REPORT_TOOL_POLICY: {
    readonly roleName: "operator-report";
    readonly allowedTools: readonly ["changes_read", "mama_provenance", "mama_recall", "mama_save", "mama_search", "report_publish", "schedule_upcoming", "task_external_correlation", "task_list", "trello_kanban"];
};
export interface WorkOrderAgentPolicy {
    agentContext: AgentContext;
    gatewayToolsPrompt: string;
    briefProjectionPolicy: PrivateConnectorPolicy;
}
/**
 * The conductor's grant (S1). Reads and judgment surfaces plus the ONE write
 * family the spec's center names: committing work orders and board cards. No
 * sends, no memory writes, no compile - the untrusted-input lane stays the
 * most restricted lane, not the least (review F2/security).
 */
export declare const CONDUCTOR_TOOL_POLICY: {
    readonly roleName: "conductor";
    readonly allowedTools: readonly ["board_read", "changes_read", "mama_recall", "mama_search", "task_create", "task_list", "task_update", "workorder_request", "workorder_status"];
};
/** Mirrors buildOperatorReportAgentPolicy - same shape, conductor grant. */
export declare function buildConductorAgentPolicy(model: string, backend: RuntimeBackend, privateConnectorPolicy: PrivateConnectorPolicy): WorkOrderAgentPolicy;
/**
 * Merge + validate the conductor config at boot. No-fallback: a malformed
 * value must crash loudly, not silently clamp (review F10: tickMs 0 spins
 * the event loop with a DB write per iteration).
 */
export declare function resolveConductorConfig(config: Pick<import('../config/types.js').MAMAConfig, 'conductor'>): import('../config/types.js').ConductorConfig;
/**
 * Build the Code-Act role the operator report lane runs under.
 *
 * Without an agentContext.role, roleAllowsOuterCodeAct() returns false (agent-loop.ts), the
 * Code-Act branch of prepareSystemPrompt strips the generic gateway catalog, and NOTHING
 * replaces it - the report agent then runs with zero tool definitions and every full report
 * logs "executed NO gateway gather tools" while still being delivered. Mirrors
 * buildWorkOrderAgentPolicy so both operator job families get their permissions the same way.
 */
export declare function buildOperatorReportAgentPolicy(model: string, backend: RuntimeBackend, privateConnectorPolicy: PrivateConnectorPolicy): WorkOrderAgentPolicy;
export declare function buildWorkOrderAgentPolicy(kind: WorkOrderKind, model: string, backend: RuntimeBackend, privateConnectorPolicy: PrivateConnectorPolicy, rawConnectorScope: readonly string[]): WorkOrderAgentPolicy;
type CodeActModelRunAdapter = Pick<DatabaseAdapter, 'prepare'>;
type CodeActExecutionResultLike = {
    success?: boolean;
    error?: {
        message?: string;
    } | string;
};
export interface CodeActParentModelRunOptions {
    inputSnapshotRef: string;
    inputRefs: Record<string, unknown>;
}
export declare function bindCodeActParentModelRun(adapter: CodeActModelRunAdapter, executionContext: GatewayToolExecutionContext | null, options: CodeActParentModelRunOptions): {
    executionContext: GatewayToolExecutionContext | null;
    modelRunId: string | null;
};
export declare function finalizeCodeActParentModelRun(adapter: CodeActModelRunAdapter, modelRunId: string | null, result: CodeActExecutionResultLike): void;
export declare function failCodeActParentModelRun(adapter: CodeActModelRunAdapter, modelRunId: string | null, error: unknown): void;
/**
 * Options for start command
 */
export interface StartOptions {
    /** Run in foreground (not as daemon) */
    foreground?: boolean;
}
export declare function buildSystemAgentProcessDefaults(config: {
    multi_agent?: {
        dangerouslySkipPermissions?: boolean;
    };
}): {
    dangerouslySkipPermissions: boolean;
};
/**
 * Execute start command
 */
export declare function startCommand(options?: StartOptions): Promise<void>;
/**
 * Run agent loop (for foreground and daemon mode).
 *
 * This is the linear orchestrator — each phase calls one or more
 * init functions and threads their results into the next phase.
 *
 * Phase  1: Foundation (config, db, oauth, metrics)
 * Phase  2: Session + Tool + Agent Loop
 * Phase  3: MAMA Core API
 * Phase  4: Memory Agent + MessageRouter
 * Phase  5: Graph Handler + Embedding
 * Phase  6: Cron Scheduler
 * Phase  7: Gateways
 * Phase  8: Gateway Wiring
 * Phase  9: Heartbeat + Connectors
 * Phase 10: API Server + Routes
 * Phase 11: Server Start + Shutdown
 */
export declare function runAgentLoop(config: Awaited<ReturnType<typeof loadConfig>>, options?: {
    osAgentMode?: boolean;
}): Promise<void>;
export {};
//# sourceMappingURL=start.d.ts.map