import type { ApprovalBroker, SharedSessionBroker } from '../control-plane/index.js';
import type { RuntimeEventBus } from '../runtime/events/index.js';
import { type RuntimeServices } from '../runtime/services.js';
import type { McpServerConfig } from '../mcp/config.js';
import type { RelayReachability } from '../relay/reachability.js';
import type { DaemonConfig, DaemonDangerConfig } from './types.js';
/**
 * DaemonServer, HTTP task server. Enabled by default via `daemon.enabled`
 * (loopback-bound), resolved via resolveDaemonEnabled.
 * All routes require Bearer token auth (set via enable()).
 * POST /task   , submit a task; returns agentId.
 * GET  /task/:id, returns agent status.
 * GET  /status , server health check.
 */
export declare class DaemonServer {
    private config;
    private enabled;
    private server;
    private port;
    private host;
    private agentManager;
    private readonly runtimeServices;
    /** Whether this server constructed its runtime graph, and so may dispose it on stop(). */
    private readonly ownsRuntimeServices;
    private readonly integrationHelpers;
    private configManager;
    private authToken;
    private userAuth;
    private githubWebhookSecret;
    private automationManager;
    private runtimeBus;
    private readonly runtimeStore;
    private readonly runtimeDispatch;
    private readonly controlPlaneGateway;
    private readonly gatewayMethods;
    private readonly sessionBroker;
    private readonly approvalBroker;
    private readonly routeBindings;
    private readonly deliveryManager;
    private readonly surfaceRegistry;
    private readonly channelPolicy;
    private readonly channelPlugins;
    private readonly channelReplyPipeline;
    /** Decides whether THIS node is the one consuming inbound channels; see facade-cluster.ts. */
    private readonly clusterCoordinator;
    private readonly watcherRegistry;
    /** Trigger family supervisor; started/stopped with the daemon so an on-exit trigger outlives the turn that created it. Undefined when the host composed its own services without one, that means no triggers, not a failure. */
    private readonly triggerManager;
    private readonly platformServiceManager;
    private readonly distributedRuntime;
    private readonly voiceService;
    private readonly webSearchService;
    private readonly knowledgeService;
    private readonly knowledgeGraphqlService;
    private readonly mediaProviders;
    private readonly multimodalService;
    private readonly artifactStore;
    private readonly serviceRegistry;
    private readonly serveFactory;
    private readonly pendingSurfaceReplies;
    private readonly controlPlaneHelper;
    private readonly surfaceDeliveryHelper;
    private readonly surfaceActionHelper;
    private readonly transportEventsHelper;
    private readonly httpRouter;
    /** Sweeps channel health and tells the owner over a channel that still works; see facade-channel-health.ts. */
    private readonly channelHealth;
    private replyPoller;
    /** Lifecycle sidecar: clean-shutdown marker, receipts, hourly auto-update. */
    private lifecycle;
    private readonly companionChatManager;
    private readonly hostedSessions;
    private relayReachability;
    private agentTaskAdapter;
    private agentTaskAdapterUnsub;
    private tlsState;
    private approvalBrokerUnsubscribe;
    /** Unsubscribe from controlPlane config key watchers; cleared on stop(). */
    private _configWatchUnsub;
    /** True while a config-driven restart is in progress, prevents re-entrancy. */
    private _restarting;
    /** Awaitable promise for the active restart cycle; null when idle. */
    private _restartingPromise;
    /** True if a config change arrived while _restarting was set; triggers a second cycle. */
    private _restartDirty;
    private tornDown;
    constructor(config?: DaemonConfig);
    listRecentControlPlaneEvents(limit?: number): readonly import('../control-plane/gateway.js').ControlPlaneRecentEvent[];
    /**
     * Enable the daemon. Caller passes the resolved enable decision (from
     * resolveDaemonEnabled). The token authenticates all requests. Returns false
     * if the passed-in flag forbids it.
     */
    enable(dangerConfig: DaemonDangerConfig, token?: string): boolean;
    /** Bound TCP port after {@link DaemonServer.start} (resolves a `port: 0` request to the real port). */
    get boundPort(): number;
    /** The host the daemon is bound to. */
    get boundHost(): string;
    /** The daemon's shared approval broker, the SAME broker the HTTP approvals routes resolve through. Exposed so embedders and boot-factory proof tests can seed/inspect approvals (bridge an external UI, or prove per-hunk approve/deny over the live wire). */
    get approvals(): ApprovalBroker;
    /** The daemon's canonical single-writer memory registry, the SAME store the HTTP memory routes serve. Exposed so embedders and boot-factory proof tests can read back a wire write as a direct canonical-store read. */
    get memory(): RuntimeServices['memoryRegistry'];
    /** The daemon's trigger-family supervisor, the same instance the fleet registry and the supervision tick use. */
    get triggers(): RuntimeServices['triggerManager'] | undefined;
    /** The daemon's runtime event bus, the SAME bus every service emits on. Exposed so an in-process embedder (see the `/embed` subpath) can subscribe to typed runtime events without going over the wire. */
    get eventBus(): RuntimeEventBus;
    /** The daemon's shared session broker, the SAME broker the HTTP session routes drive. Exposed so an in-process embedder can submit input to a session directly. */
    get sessions(): SharedSessionBroker;
    /**
     * Cancel a running agent by id, the SAME cooperative-plus-abort cancellation
     * the operator kill path uses: it flips the agent to `cancelled` and aborts the
     * agent's in-flight provider call so the turn stops mid-flight rather than
     * running to completion. Returns false for an unknown id. Exposed so an
     * in-process embedder (the ACP adapter) can honor a client `session/cancel` as
     * a real cancellation of the session's active agent.
     */
    cancelAgent(agentId: string): boolean;
    /**
     * Connect a single MCP server by config into this daemon's live MCP registry,
     * the SAME registry that namespaces tools as `mcp:<name>:<tool>`. Exposed so an
     * in-process embedder (the ACP adapter) can wire the MCP servers a client
     * declared in `session/new` into the session's tool surface. stdio transport
     * only (the registry spawns a process); an error connecting one server is
     * surfaced to the caller.
     */
    registerMcpServer(config: McpServerConfig): Promise<void>;
    /**
     * Start the daemon. Refuses to start if not explicitly enabled.
     */
    start(): Promise<void>;
    /**
     * Wait for any in-progress config-driven restart to settle.
     * Callers that change config mid-flight and need to know when the server
     * has rebounded should await this before inspecting state.
     */
    waitForRestart(): Promise<void>;
    stop(): Promise<void>;
    /** Undelivered daemon receipts for the /status payload (marked delivered once served). */
    collectDaemonReceipts(): readonly {
        id: string;
        text: string;
        at: number;
    }[];
    /**
     * Subscribe to controlPlane binding keys and restart the server on change.
     * Called once from start() after the server is up. Clears itself on stop().
     */
    private _attachControlPlaneConfigWatcher;
    /**
     * Returns true if the server is currently running.
     */
    get isRunning(): boolean;
    private extractAuthToken;
    private checkAuth;
    private requireAuthenticatedSession;
    private requireAdmin;
    private requireRemotePeer;
    private describeAuthenticatedPrincipal;
    private getGrantedGatewayScopes;
    private validateGatewayInvocation;
    private tryUpgradeControlPlaneWebSocket;
    private handleControlPlaneWebSocketOpen;
    private handleControlPlaneWebSocketMessage;
    private handleControlPlaneWebSocketClose;
    private invokeWebSocketControlPlaneCall;
    private invokeGatewayMethodCall;
    private handleRequest;
    /** The relay reachability controller (null until start). Exposed for surfaces. */
    getRelayReachability(): RelayReachability | null;
    private dispatchApiRoutes;
    private parseJsonBody;
    private parseOptionalJsonBody;
    private parseJsonText;
    private recordApiResponse;
    private handleApprovalAction;
    private trySpawnAgent;
    private syncSpawnedAgentTask;
    private syncFinishedAgentTask;
    private surfaceDeliveryEnabled;
    private pollPendingSurfaceReplies;
    private trustProxyEnabled;
    private signWebhookPayload;
}
//# sourceMappingURL=facade.d.ts.map