import { type Server } from 'node:http';
export interface RpcContext {
    platform: string;
    channelId: string;
    threadId: string;
    userId: string;
}
interface TokenEntry {
    ctx: RpcContext;
    /** ms-epoch expiry. After this time the token is rejected. */
    expiresAt: number;
    /** Where the token was minted from — purely for diagnostic logs. */
    origin: string;
}
/**
 * Mint a new RPC token bound to a specific IM thread. Returns the hex
 * token + the socket path subprocesses should connect to. Callers
 * should pass these to spawn() via env so the child inherits them
 * unconditionally (and not via argv — argv shows up in `ps`).
 */
export declare function mintRpcToken(ctx: RpcContext, origin?: string): {
    token: string;
    socketPath: string;
    expiresAt: number;
};
/** Revoke a token explicitly. Token registry is also pruned on a
 *  periodic sweep, so revoke is best-effort cleanup, not required. */
export declare function revokeRpcToken(token: string): void;
export declare function resolveSocketPath(): string;
/**
 * Start the local RPC server on a Unix socket. Idempotent — repeated
 * calls return the same handle. Best-effort: a failure to start (e.g.
 * permission denied on the socket path) logs at warn and resolves to
 * `null` so the rest of agim boots normally.
 */
export declare function startRpcServer(): Promise<Server | null>;
/** Graceful shutdown — called on SIGTERM. */
export declare function stopRpcServer(): Promise<void>;
/** Internal-only — used by tests to snapshot token state. */
export declare function _peekTokensForTests(): Map<string, TokenEntry>;
export {};
//# sourceMappingURL=agim-rpc-server.d.ts.map