import { type IControllerMessage, type IControllerMessageBundle, type IControllerMessagePage, type IControllerReasoningUpdate, type IControllerTextUpdate, type IControllerPermission, type IControllerQuestion, type IControllerSession, type IControllerStatus, type IControllerToolExecution } from '../dist_ts_interfaces/index.js';
import type { IControllerStartOptions, IControllerStartResult } from './interfaces.lifecycle.js';
/**
 * Boot-time Flex startup may not delay controller readiness beyond this
 * budget. Detached `agl start` and the upgrade worker wait a bounded time for
 * readiness, while Flex initialization (reversion maintenance over large
 * projects) can legitimately take minutes under its 30 minute lifecycle
 * deadline; past the budget the harness continues through Flex recovery.
 */
export declare const controllerFlexBootStartupBudgetMs = 30000;
export declare const controllerOpenCodeRestartDelayMs: (attemptArg: number) => number;
export declare const controllerFlexRestartDelayMs: (attemptArg: number) => number;
export declare const boundControllerMessagePage: (pageArg: IControllerMessagePage, maximumBundlesArg?: number, protectedMessageCheckArg?: (messageArg: IControllerMessage) => boolean) => IControllerMessagePage;
export declare const boundControllerMessageBundle: (bundleArg: IControllerMessageBundle) => IControllerMessageBundle;
export declare const mergeControllerMessagePageSnapshots: (pageArg: IControllerMessagePage, executionsArg: readonly IControllerToolExecution[], reasoningUpdatesArg: readonly IControllerReasoningUpdate[], textUpdatesArg: readonly IControllerTextUpdate[]) => IControllerMessagePage;
export declare const mergeFlexReasoningUpdatesIntoDetail: <TDetail extends {
    messages: IControllerMessage[];
    session?: IControllerSession;
}>(detailArg: TDetail, updatesArg: readonly IControllerReasoningUpdate[]) => TDetail;
export declare const mergeFlexTextUpdatesIntoDetail: <TDetail extends {
    messages: IControllerMessage[];
    session?: IControllerSession;
}>(detailArg: TDetail, updatesArg: readonly IControllerTextUpdate[]) => TDetail;
export declare const mergeOpenCodeReasoningUpdatesIntoDetail: <TDetail extends {
    messages: IControllerMessage[];
    session?: IControllerSession;
}>(detailArg: TDetail, updatesArg: readonly IControllerReasoningUpdate[]) => TDetail;
export declare const mergeOpenCodeTextUpdatesIntoDetail: <TDetail extends {
    messages: IControllerMessage[];
    session?: IControllerSession;
}>(detailArg: TDetail, updatesArg: readonly IControllerTextUpdate[]) => TDetail;
export declare const settleControllerAttentionLists: (permissionsPromiseArg: Promise<IControllerPermission[]>, questionsPromiseArg: Promise<IControllerQuestion[]>, reportErrorArg?: (message: string, error: unknown) => void) => Promise<{
    permissions: IControllerPermission[];
    questions: IControllerQuestion[];
}>;
export declare const isControllerWebSocketRequestAllowed: (headersArg: Headers, publicOriginArg: string, tlsModeArg: "local" | "proxy", trustedProxySecretArg?: string) => boolean;
export type TControllerManagedSessionAuthority = 'managed' | 'definitively_unmanaged' | 'uncertain';
export declare class OpenCodeController {
    readonly options: IControllerStartOptions;
    private readonly startedAt;
    private lifecycleState;
    private processGroupId;
    private processFingerprint;
    private processIdentity?;
    private mcpControllerHost?;
    private setupRequired;
    private setupCodeExpiresAt?;
    private projectIdsByDirectory;
    private readonly managedSessionAuthorities;
    /** Credentials minted for chats this controller generation spawned. Never persisted. */
    private readonly mcpCallerRegistry;
    private defaultModels;
    private autoAcceptPermissions;
    private activeBrowserVideoBackend;
    private readonly yoloSessionsByProjectKey;
    private readonly unusedSessionStates;
    private readonly claimedSessionKeys;
    private claimedSessionEvictionGeneration;
    /** sha256(token) -> auth payload; memory-only, cleared on stop */
    private readonly resumeTokens;
    private readonly autoRepliedPermissionIds;
    private readonly flexProviderLogins;
    private readonly flexRefreshJobs;
    private readonly pendingFlexFinishedJobs;
    private readonly pendingFlexFinishedPrompts;
    private readonly activeFlexRuns;
    private readonly flexDelegationTicketsByPermission;
    private readonly flexDelegationTicketsByContext;
    private readonly flexDelegatedRunLeases;
    private readonly flexDelegatedRunLeasesByRun;
    private readonly flexDelegatedRunLeasesBySession;
    private flexDelegatedRunLeaseIssuer?;
    private readonly pendingFlexRunCleanups;
    private readonly pendingFlexProjectRegistrationOperations;
    private readonly flexBrowserChannelAuthorities;
    private readonly currentFlexEventGenerations;
    private flexRunAuthorityFenced;
    private flexGlobalCleanupPending;
    private flexGlobalCleanupGeneration;
    private flexGlobalCleanupPromise?;
    private readonly flexModelOptionsByConnection;
    private readonly flexProviderConnectionMutationTails;
    private readonly flexModelRefreshAdmissionTasks;
    private readonly flexProviderNames;
    private readonly pendingOpenCodeControllerEvents;
    private readonly childScopesByGeneration;
    private readonly childScopeGenerationByBinding;
    private readonly childScopeOpenTails;
    private readonly openCodeAutoAcceptExactAdmissions;
    private readonly openCodeAutoAcceptFamilyAdmissions;
    private readonly sealedOpenCodeAutoAcceptFamilyKeys;
    private openCodeAutoAcceptAdmissionSealCount;
    private childScopeCleanupTimer?;
    private pendingChildScopeEventCount;
    private pendingChildScopeEventBytes;
    private readonly latestOpenCodeToolExecutions;
    private readonly latestOpenCodeReasoningUpdates;
    private readonly latestOpenCodeTextUpdates;
    private readonly latestFlexToolExecutions;
    private readonly latestFlexReasoningUpdates;
    private readonly latestFlexTextUpdates;
    private readonly pendingFlexControllerEvents;
    private readonly pendingFlexAutoAcceptSweeps;
    private openCodeControllerEventDrainTask?;
    private openCodeToolStreamEpoch;
    private openCodeToolStreamRevision;
    private openCodeMessageStreamEpoch;
    private openCodeMessageStreamRevision;
    private flexToolStreamEpoch;
    private flexToolStreamRevision;
    private flexMessageStreamEpoch;
    private flexMessageStreamRevision;
    private latestFlexToolExecutionBytes;
    private latestFlexMessageUpdateBytes;
    private pendingFlexToolEventBytes;
    private pendingFlexMessageEventBytes;
    private flexControllerEventDrainTask?;
    private flexAutoAcceptDrainTask?;
    private runtimeConfig?;
    private controllerId?;
    private openCodeRuntimeDirectory?;
    private authStore?;
    private passkeyManager?;
    private openCodeSupervisor?;
    private openCodeClient?;
    private flexSupervisor?;
    private codexSupervisor?;
    private codexConnections?;
    private codexDefaultProfileId?;
    private codexLocalProfileId?;
    private codexStartupDiagnostic?;
    private codexClient?;
    private codexCreationAdmissions;
    private codexRestartTask?;
    private codexRestartProfileId?;
    private readonly codexCleanupTasks;
    private readonly codexRecoveryDiagnostics;
    private readonly queuedCodexPrompts;
    private readonly codexQueueDrains;
    private readonly pausedCodexQueues;
    private readonly codexCreationFinalizations;
    private readonly codexPendingEvents;
    private codexEventDrain?;
    private readonly openCodeSupervisorExitSignals;
    private readonly flexSupervisorExitSignals;
    private flexProjectionReader?;
    private gitReversion?;
    private readonly pendingProjectRemovalTasks;
    private readonly projectResourceReconciliationRetries;
    private flexProjectionReaderReady;
    private flexServiceInit?;
    private flexRecoveryReady;
    private flexUnsupported;
    private flexRestartAttempt;
    private flexRestartTimer?;
    private flexBootStartupBudgetMs;
    private gitReversionTemporaryRoot?;
    private gitReversionReplacement?;
    private gitReversionReplacementTimer?;
    private gitReversionReplacementAttempt;
    private flexRestartTask?;
    private flexHarnessAdmissionFenceGeneration?;
    private flexChildExitCleanupPending;
    private flexChildExitCleanupTask?;
    private flexGenerationCleanup?;
    private readonly plannedFlexSupervisorStops;
    private flexMigrationDatabase?;
    private flexMigrationStore?;
    private flexMigrationCleanupPromise?;
    private controllerProjectMutationTail;
    private flexProjectReconciliationRetryTask?;
    private unsubscribeFlexEvents?;
    private terminalManager?;
    private terminalResourceHost?;
    private browserResourceHost?;
    private resourceCoordinator?;
    private readonly browserViews;
    private readonly browserViewSlots;
    private readonly authenticatedPeerIds;
    private readonly authenticatedPeerGenerations;
    private openCodeResourceGeneration;
    private flexResourceGeneration;
    private typedServer?;
    private unsubscribeConnectionClose?;
    private eventStreamTask?;
    private openCodeFailClosedTask?;
    private openCodeFailClosedRetryTimer?;
    private openCodeRestartAttempt;
    private openCodeRestartTimer?;
    private openCodeRestartTask?;
    private openCodeRetainedCleanupAttempt;
    private openCodeRetainedCleanupTimer?;
    private openCodeRetainedCleanupTask?;
    private openCodeCrashRecovery?;
    private openCodeHarnessAdmissionFenceGeneration?;
    private openCodeRuntimeMutationTail;
    private flexRunCleanupRetryTimer?;
    private startPromise?;
    private stopPromise?;
    private stopRequested;
    private controllerStartedRecorded;
    private controllerStoppedRecorded;
    private readonly operationAbortController;
    private readonly activeOperations;
    private readonly harnessSessionEnumerationTasks;
    private readonly completeHarnessSessionRuntimeIdsByList;
    private readonly sessionLayoutOperationTails;
    private readonly sessionLayoutOperationDepths;
    private readonly sessionStateMutationTails;
    private readonly harnessOperationManager;
    private upgradeCoordinator?;
    private upgradeToken?;
    private upgradeStatus?;
    private upgradeBarrier?;
    private openCodeAccountSwitchBarrier?;
    private openCodeAccountSwitchTask?;
    private authSwitchHarnesses?;
    /** Serializes controller-run credential operations; authswitch's store lock is exclusive. */
    private authSwitchCredentialTail;
    private authSwitchService?;
    private openCodeAccountSwitchAdmissionSealed;
    private selectedOpenCodeProviderConnectionId?;
    private readonly plannedOpenCodeSupervisorStops;
    private readonly retainedOpenCodeRuntimeCleanup;
    private openCodeRuntimeAdmissionSealed;
    private sessionIntelligenceFlexAdmissionSealed;
    private openCodeRuntimeLeaseCount;
    private openCodeRuntimeLeaseDrained?;
    private readonly openCodeRuntimeLeaseReleases;
    private upgradePreparationAbortController?;
    private upgradePreparationTask?;
    private upgradePreparationAdmissionTail;
    private upgradeFinalizeTail;
    private upgradeWorkerWatchdog?;
    private upgradeWorkerWatchdogTask?;
    private retainedUpgradeOwnershipTask?;
    private retainedUpgradeLock?;
    private retainedUpgradeReleaseTask?;
    private readonly activeSessionBackgroundOperations;
    private readonly openCodeOperationMonitors;
    private readonly queuedOpenCodePromptSubmissions;
    private readonly openCodePromptQueueDrainTasks;
    private readonly openCodePromptQueueFenceCounts;
    private readonly openCodeSessionErrorCleanupTasks;
    private readonly sessionIntelligenceJobs;
    private readonly sessionIntelligenceCapabilities;
    private readonly projectSessionIntelligenceAdmissions;
    private readonly sessionIntelligenceAdmissions;
    private readonly retiringProjectIds;
    private readonly retiringSessionKeys;
    private readonly archivingSessionKeys;
    private readonly archivePreflightReads;
    private readonly abortingSessionKeys;
    private readonly projectArchiveAdmissions;
    private readonly projectHarnessSubmissionAdmissions;
    private readonly flexProjectHostRequestAdmissions;
    private readonly flexSessionHostRequestAdmissions;
    private readonly sealedFlexProjectHostRequestAdmissions;
    private readonly sealedFlexSessionHostRequestAdmissions;
    private readonly flexProjectIdentityRecoveryPending;
    private readonly sessionHarnessSubmissionAdmissions;
    private activeSessionIntelligenceJobCount;
    private sessionIntelligenceCleanupTimer?;
    private sessionIntelligenceCleanupTask?;
    private readonly systemMetricsSampler;
    /**
     * The account authority view. Supervised from `start()`, so a host whose daemon is not running --
     * or a controller that was given no endpoints at all -- holds a named `absent` state instead of
     * failing startup. Built in the constructor because it reads `options`.
     */
    private readonly authorityState;
    private readonly activeOperationCountsByPeer;
    private protectedOperationWindowStartedAt;
    private protectedOperationCount;
    private readonly protectedOperationCountsByPeer;
    private unauthenticatedAuditWindowStartedAt;
    private unauthenticatedAuditCount;
    private readonly unauthenticatedAuditCountsByPeer;
    private unauthenticatedPreflightWindowStartedAt;
    private unauthenticatedPreflightCount;
    private readonly unauthenticatedPreflightCountsByPeer;
    constructor(optionsArg: IControllerStartOptions);
    private captureInheritedUpgradeCoordination;
    start(): Promise<IControllerStartResult>;
    stop(): Promise<void>;
    getStatus(): IControllerStatus;
    private statusForPrincipal;
    private listProjectsForPrincipal;
    private requireCodexClient;
    private codexDirectory;
    private codexConnectionForProject;
    private releaseCodexRuntimeOperations;
    private codexComposerContext;
    private handleCodexUnavailable;
    private queueCodexPromptIfBlocked;
    private codexQueueCanDispatch;
    private scheduleQueuedCodexPrompt;
    private dispatchQueuedCodexPrompt;
    private restartCodexRuntime;
    private queueCodexEvent;
    private initializeCodexRuntime;
    private startCodexRuntime;
    private recoverCodexProfile;
    private recoverCodexRuntimeObligations;
    private queueCodexAutoAccept;
    private recoverCodexCreations;
    private finalizeCodexCreation;
    private createCodexSession;
    private codexModeModelChoice;
    private forkCodexSession;
    private readManagedCodexSession;
    private listManagedCodexSessions;
    private withCodexDiscoveryAdmission;
    private readCodexSessionDetail;
    /** Selects only identities that authswitch itself can prove from the session's credential owner. */
    private authSwitchLimitsContext;
    private assertCodexComposerMutationAllowed;
    /**
     * Projects that hold at least one tracked conversation and whose directory is available.
     * Bounded, because one browser read must never fan out over every registered project.
     */
    private trackedConversationProjectScope;
    /**
     * Live harness state for the tracked conversations of one project, without admitting anything:
     * a conversation AGL does not already track stays invisible here.
     */
    private resolveTrackedProjectSessions;
    /** A conversation archived in AGL renders from its durable cache, never from a harness read. */
    private trackedConversationFromCache;
    private toTrackedConversation;
    private listTrackedConversationsForPrincipal;
    /**
     * Directories the conversation search covers: registered projects first, then the immediate
     * subdirectories of the configured standard directories that are not registered yet.
     */
    private resolveConversationSearchCandidates;
    private searchConversationsForPrincipal;
    /**
     * Admit an existing harness conversation into AGL's managed set. Unlike folder discovery this
     * is an explicit user intent, so it admits archived roots too, but never a subagent.
     */
    private admitExistingConversation;
    private openConversationForPrincipal;
    private setConversationArchivedForPrincipal;
    /** Track a conversation AGL just created. Tracking never gates the creation itself. */
    private trackCreatedConversation;
    private pushTrackedConversationsChanged;
    /** Absolute existing directories only; a missing one is rejected instead of stored. */
    private resolveStandardProjectDirectories;
    private listSessionsForPrincipal;
    private readSessionForPrincipal;
    private readSessionScratchpadForPrincipal;
    private updateSessionScratchpadForPrincipal;
    private sendSessionForPrincipal;
    private createProjectForPrincipal;
    private listModelsForPrincipal;
    private createSessionForPrincipal;
    private updateSessionModelForPrincipal;
    private renameSessionForPrincipal;
    private archiveSessionForPrincipal;
    private abortSessionForPrincipal;
    /** Internal lifecycle work observes an exact native turn before issuing its interrupt. */
    private abortObservedCodexTurn;
    private listResourcesForPrincipal;
    private createResourceForPrincipal;
    private renameResourceForPrincipal;
    private attachResourceForPrincipal;
    private detachResourceForPrincipal;
    private startResourceForPrincipal;
    private stopResourceForPrincipal;
    private publicSettings;
    private readControllerSettings;
    private updateControllerSettings;
    private retireResourceForPrincipal;
    private prepareMcpSessionTarget;
    private resolveMcpContext;
    /** The chat this MCP call runs as, proven by the credential on the request envelope. */
    private mcpCaller;
    private mcpIdentityRequired;
    private mcpSubjectForbidden;
    /** Discovery and mutation both require an identity; only the reach differs. */
    private requireMcpSubject;
    /**
     * Resource operations act inside one project. A task or terminal subject owns exactly its own
     * project; a shared OpenCode runtime is scoped to the project named in the request.
     */
    private requireMcpResourceSubject;
    /**
     * Task *mutations* are limited to the caller's own task; a terminal subject owns no task and an
     * unidentified host owns nothing. Task reads are deliberately not gated here: a cross-harness
     * chat outside any AGL terminal still reads AGL-managed tasks with the descriptor token alone.
     *
     * The gate also binds the task to the project named in the request, so a shared harness runtime
     * — which owns no single task — cannot reach a task outside the project it addressed.
     */
    private requireMcpSessionMutationTarget;
    /** A caller sees what is attached to it, plus what is attached to nothing. */
    private filterMcpVisibleResources;
    private mcpAttachmentTargetFor;
    /**
     * The membership an MCP caller may remove: its own. A shared runtime owns no single chat, so it
     * must name which of its own tasks to release, the same rule attach applies.
     */
    private mcpDetachEntryFor;
    /** Detaching is an ownership operation: only a subject may release its own resource. */
    private assertMcpResourceOwnership;
    private executeMcpBrowserAction;
    /**
     * The conversation a terminal subject drives as: the coding agent's own chat, carried by the
     * resource's terminal entry for exactly this terminal and conversation. A plain shell terminal
     * carries none and therefore drives nothing — matching the binding, which admits a terminal's
     * conversation only when the entry names one.
     */
    private terminalActingSessionId;
    private createControllerMcpApi;
    private performStart;
    private coordinatorForUpgradeToken;
    private startOpenCodeEventStream;
    private acquireOpenCodeRuntimeLease;
    private abortOpenCodeRuntimeLeases;
    private sealOpenCodeRuntimeAdmission;
    private waitForOpenCodeRuntimeLeases;
    private createOpenCodeSupervisor;
    private handleOpenCodeChildExitCleanup;
    private createRuntimeExitSignal;
    private createOpenCodeClient;
    private assertOpenCodeStartupRuntimeReady;
    private sealOpenCodeRuntimeAuthority;
    private reopenOpenCodeRuntimeAuthority;
    private withOpenCodeRuntimeMutation;
    private closeFlexMigrationResources;
    private flexIsOperational;
    private sealFlexRuntimeAuthority;
    private reopenFlexRuntimeAuthority;
    private resolveSessionIdentityProjects;
    private withCurrentSessionIdentityProjects;
    private assertOpenCodeSessionIdentitySourceFenced;
    private assertFlexSessionIdentitySourceFenced;
    private assertFlexProjectSessionIdentitySourceFenced;
    private requireOpenCodeRuntimeExitAuthority;
    private requireFlexRuntimeExitAuthority;
    private assertOpenCodeSessionIdentityGenerationCurrent;
    private assertFlexSessionIdentityGenerationCurrent;
    private readFlexSessionIdentitySnapshot;
    private captureFlexCleanupCohort;
    private reconcileOpenCodeSessionIdentities;
    private reconcileFlexSessionIdentities;
    private reconcileFlexProjectSessionIdentities;
    private registerFlexProjectForReconciliation;
    private recoverOpenCodeManagedSessionDeletions;
    private recoverFlexManagedSessionDeletions;
    private completeRecoveredManagedSessionDeletion;
    private recoverOpenCodeManagedSessionCreations;
    private recoverFlexManagedSessionCreations;
    private ensureFlexProjectionReader;
    private canRestartOpenCode;
    private scheduleOpenCodeRestart;
    private startOpenCodeRestartAttempt;
    private scheduleRetainedOpenCodeRuntimeCleanup;
    private startRetainedOpenCodeRuntimeCleanupAttempt;
    private retainOpenCodeRuntimeCleanup;
    private forgetOpenCodeRuntimeCleanup;
    private closeSessionIntelligenceCapabilitiesForOpenCodeSupervisor;
    private completeOpenCodeCrashCleanup;
    private cleanupOpenCodeCrashGeneration;
    private retryRetainedOpenCodeRuntimeCleanup;
    private restartOpenCode;
    private createGitReversion;
    private canReplaceGitReversion;
    private scheduleGitReversionReplacement;
    /**
     * Replaces a Git reversion engine that sealed itself after incomplete Git
     * process cleanup. The sealed engine must confirm its child processes closed
     * before a fresh engine takes over project registration and recovery, so a
     * single unconfirmed child can no longer disable reversion until restart.
     */
    private replaceSealedGitReversion;
    /**
     * Starts the Flex child at controller boot under the boot budget. When the
     * budget expires the start is aborted, the supervisor stops the child, and
     * Flex recovery brings the harness up after the controller is ready, where
     * only the lifecycle deadline applies. Readiness therefore never depends on
     * how long Flex initialization takes.
     */
    private startFlexWithinBootBudget;
    private canRestartFlex;
    private scheduleFlexRestart;
    private startFlexRestartAttempt;
    private stopOwnedFlexSupervisor;
    private failClosedFlexAfterSessionIntelligenceCleanup;
    private closeSessionIntelligenceCapabilitiesForFlexSupervisor;
    private cleanupFlexGeneration;
    private waitForFlexGenerationCleanup;
    private cleanupFlexAfterChildExit;
    private restartFlex;
    private handleWebSocketConnectionClose;
    private performStop;
    /**
     * Composes the three auth scopes. A handler is guarded by the scope router it is
     * registered on and by nothing else, so each `register*Handlers` method is handed
     * exactly one scope here, and test/test.routerscopes.node.ts freezes the resulting
     * method-to-scope table.
     */
    private createRouter;
    /** Public scope: a browser reads the status before it holds a passkey session. */
    private registerStatusHandlers;
    /**
     * Public scope: the caller is the upgrade command, which holds no passkey session.
     * Every handler here authorises itself against the upgrade token it is handed.
     */
    private registerUpgradeHandlers;
    /**
     * Passkey ceremonies and session resume. The passkey manager binds every ceremony
     * step to the configured origin, so this is the one group that is handed it.
     */
    private registerAuthHandlers;
    /**
     * Process-local diagnostics reads. They change nothing and the owner opens them
     * while errors pile up, so they stay outside the audited pipeline.
     */
    private registerDiagnosticsHandlers;
    private registerProjectHandlers;
    private registerSlashHandlers;
    private registerAuthSwitchHandlers;
    /**
     * The account authority view. One read, no polling companion: a change is announced with the
     * `accounts.changed` controller event, which is the same push channel every other live controller
     * state uses, and the client answers it by reading this method.
     */
    private registerAccountsHandlers;
    private registerProviderHandlers;
    private registerCodexHandlers;
    private registerModelHandlers;
    private registerSettingsHandlers;
    private registerConversationHandlers;
    /** Chat sessions and the session-group layout that organises them. */
    private registerSessionHandlers;
    /**
     * Owner answers to a harness permission or question prompt. The child-session variants
     * are scoped through their parent session and live with the session handlers.
     */
    private registerPromptReplyHandlers;
    private registerResourceHandlers;
    private registerBrowserHandlers;
    private registerTerminalHandlers;
    private runAudited;
    private requireProjectsRoot;
    private registerExplicitInitialProject;
    /** `created` is false when the directory was already a registered project. */
    private createProjectAndReconcile;
    /**
     * The durable deregistration used by `controller.project.remove` and by the rollback of an
     * implicit registration. A failure schedules the resumable pending removal, exactly as the
     * operator-initiated path does, so a half-removed project is never left unattended.
     */
    private removeRegisteredProject;
    private settleManagedSessionsForProjectRemoval;
    private admitProjectRemovalCreationIfPresent;
    private reconcileProjectStateInMutation;
    private reconcileProjectState;
    private scheduleFlexProjectReconciliationRetry;
    private waitForFlexProjectReconciliationRetry;
    private finishProjectRemoval;
    private runControllerProjectMutation;
    private resolveCurrentReconciliationProject;
    private schedulePendingProjectRemoval;
    /**
     * Stops retrying a pending removal that failed deterministically and records why. The removal
     * itself is never abandoned: the durable intent, the Git reversion state and the Flex cleanup
     * authority all stay exactly as they are until the operator retries.
     */
    private blockPendingProjectRemoval;
    /** Drops a recorded block so the workspace stops showing it while the attempt runs. */
    private clearPendingProjectRemovalBlock;
    /** Pending removals the controller stopped retrying, as the workspace shows them. */
    private listBlockedProjectRemovals;
    /**
     * Resumes a removal that the controller stopped retrying. It acts on a blocked removal and on
     * nothing else: a removal that is still being retried owns its own schedule, and clearing its
     * state from here would take the project away from the attempt that is driving it.
     */
    private retryBlockedProjectRemoval;
    private pushProjectsChanged;
    private waitForPendingProjectRemovalRetry;
    private defaultModelForHarness;
    private validateControllerModelChoice;
    private isFlexModelValidationMiss;
    private validateFlexModelOnProviderConnection;
    private validFlexModelProviderConnections;
    private resolveFlexModelProviderConnection;
    private withResolvedFlexModelConnection;
    private withEffectiveFlexModelChoice;
    private resolveSessionIntelligenceModel;
    private resolveSessionIntelligenceAvailability;
    private soleActiveFlexDefaultModelChoice;
    private beginFlexModelRefresh;
    private beginFlexModelRefreshUnqueued;
    private hydrateFlexProviderCatalogs;
    private listFlexProviderConnections;
    private withFlexProviderConnectionMutation;
    private withFlexProviderConnectionMutations;
    private createAuthSwitchOpenCodeHarness;
    private getAuthSwitchHarnesses;
    private getAuthSwitchService;
    /**
     * What a switch means for each harness, so no view has to know which harness behaves how. The
     * adapters declare whether their running instances pick a swapped login up by themselves; the
     * restart is AGL's own coordination.
     */
    private authSwitchHarnessBehaviour;
    /** A selected Flex connection records account association; native OpenCode owns its refreshed credential. */
    private reconcileSelectedOpenCodeAccount;
    /**
     * Runs one controller-owned credential operation at a time.
     *
     * authswitch takes an exclusive on-disk lock for the duration of a mutation and reports a locked
     * store as a failure. Collisions were impossible while every credential operation queued behind the
     * runtime transaction. A read-only save no longer queues there, so the mutual exclusion is explicit
     * -- without it a save could fail the switch that has already stopped OpenCode.
     */
    private withAuthSwitchCredentialLock;
    /**
     * A save that keeps the login active only reads OpenCode's credential file and writes to
     * authswitch's own store. Stopping the runtime and waiting for idle work would interrupt live
     * sessions for an operation that replaces nothing, so it runs directly.
     */
    private performAuthSwitchOpenCodeKeepSave;
    private coordinateAuthSwitch;
    private readAuthSwitchOpenCodeBusyCount;
    private prepareAuthSwitchOpenCodeRecovery;
    /** The controller owns the entire transaction, including recovery after a browser/CLI disconnect. */
    private performAuthSwitchOpenCodeMutation;
    private activateOpenCodeProviderConnection;
    private performOpenCodeProviderConnectionActivation;
    private readActiveOpenCodeProviderAuth;
    private persistSelectedOpenCodeProviderConnection;
    private currentOwnedOpenCodeRuntime;
    private startStagedOpenCodeRuntime;
    private installOpenCodeRuntime;
    private stopOwnedOpenCodeRuntime;
    private stopUninstalledOpenCodeSupervisor;
    private resolveOpenCodeAccountSwitchCohort;
    private continueOpenCodeAccountSwitchSessions;
    private remainingOpenCodeAccountSwitchMs;
    private releaseOpenCodeAccountSwitchAdmission;
    private clearFlexProviderConnectionChoices;
    private logoutFlexProviderConnection;
    private recoverDeletingFlexProviderConnections;
    private recoverDeletingFlexProviderConnection;
    private toFlexModelChoice;
    private listFlexSessions;
    private markManagedSessionAuthorityScopeUncertain;
    private deleteManagedSessionAuthorityCacheEntry;
    private markRetiredSessionAuthority;
    private clearRetiredSessionAuthorityIfCurrent;
    private scheduleProjectResourceReconciliationRetry;
    private runProjectResourceReconciliationRetry;
    private abortProjectResourceReconciliationRetry;
    private pruneManagedSessionAuthorityCacheScope;
    private clearManagedSessionAuthorityProjectScope;
    private filterManagedSessions;
    private enumerateHarnessSessions;
    private toFlexSession;
    private findArchivedLayoutSessionIds;
    private assertAttentionRequestOwned;
    private toFlexMessageBundle;
    private toFlexPermission;
    private sessionStateMutationKey;
    private withSessionStateMutation;
    private withSessionCreationAdmission;
    private withActiveSessionMutation;
    private reserveHarnessSubmissionAdmission;
    private reserveAdmissionEntry;
    private withHarnessSubmissionAdmission;
    private waitForAdmissionDrain;
    private waitForPromiseWithSignal;
    private runWithSignal;
    private waitForProjectHarnessSubmissionAdmissions;
    private waitForFlexProjectHostRequestAdmissions;
    private waitForFlexSessionHostRequestAdmissions;
    private waitForSessionHarnessSubmissionAdmissions;
    private waitForProjectArchiveAdmissions;
    private assertSessionMutationAdmission;
    private startSessionBackgroundOperation;
    private abortSessionBackgroundOperation;
    private abortProjectSessionBackgroundOperations;
    private abortActiveHarnessOperation;
    private abortProjectHarnessOperations;
    private reserveProjectSessionIntelligenceAdmission;
    private reserveSessionIntelligenceAdmission;
    private reserveSessionIntelligenceAdmissionEntry;
    private waitForProjectSessionIntelligenceAdmissions;
    private waitForSessionIntelligenceAdmissions;
    private waitForAllProjectSessionIntelligenceAdmissions;
    private assertSessionExists;
    private managedSessionAuthorityKey;
    private setManagedSessionAuthority;
    private managedSessionAuthority;
    private readManagedSession;
    private readManagedOpenCodeScopeAuthority;
    private childScopeBindingKey;
    private childScopeParentKey;
    private childScopeCredentialId;
    private setAuthenticatedPeerCredential;
    private childScopeInvalid;
    private assertChildScopeParentAdmission;
    private observeOpenCodeDirectChild;
    private resolveOpenCodeFamilyAuthority;
    private openCodeFamilyAdmissionKey;
    private openCodeExactFamilyAdmissionKey;
    private openCodeFamilyAuthoritiesEqual;
    private acquireOpenCodeAutoAcceptAdmissionSeal;
    private reserveOpenCodeAutoAcceptAdmission;
    private waitForAllOpenCodeAutoAcceptAdmissions;
    private waitForOpenCodeFamilyAutoAcceptAdmissions;
    private childScopeObservedMode;
    private refreshChildScopeExpiry;
    private childScopeDescriptor;
    private startChildScopeCleanupTimer;
    private stopChildScopeCleanupTimerIfIdle;
    private cleanupExpiredChildScopes;
    private deleteChildScope;
    private revokeChildScope;
    private revokeChildScopesForPeer;
    private revokeChildScopesForProject;
    private revokeChildScopesForParent;
    private revokeAllChildScopes;
    private queueChildScopeEventForSession;
    private queueChildScopeEvent;
    private drainChildScopeEvents;
    private sendChildScopeEvent;
    private withChildScopeOpen;
    private assertChildScopeCapacity;
    private revalidateChildScope;
    private assertChildScopeRecordCurrent;
    private requireChildScope;
    private boundOpenCodeChildMessagePage;
    private openChildScope;
    private readBrowserChildAttention;
    private sessionEventIsManaged;
    private readControllerSession;
    private assertSessionIsNotIntelligenceTemporary;
    private getFlexSessionMetrics;
    private executeSessionIntelligenceJob;
    private createSessionIntelligenceCapability;
    private closeSessionIntelligenceCapability;
    private beginSessionIntelligenceCapabilityRequest;
    private assertSessionIntelligenceCapabilityActive;
    private listSessionIntelligenceChats;
    private readSessionIntelligenceChat;
    private boundSessionIntelligenceMessageText;
    private findHiddenSessionIntelligenceChatIds;
    private boundSessionIntelligenceTranscript;
    private isCanonicalIsoDate;
    private waitForSessionIntelligenceResult;
    private cancelAndDrainSessionIntelligenceJob;
    private waitForSessionIntelligencePoll;
    private requireControllerId;
    private recoverSessionIntelligence;
    private scheduleSessionIntelligenceCleanup;
    private startSessionIntelligenceCleanupTimer;
    private stopSessionIntelligenceCleanupTimer;
    private drainOpenCodeOperationMonitors;
    private retireProjectSessionIntelligence;
    private drainSessionIntelligenceOperations;
    private waitForSessionIntelligenceOperations;
    private cleanupSessionIntelligenceOrphans;
    private getFlexSessionDetail;
    private toPublicProviderConnection;
    private toPublicProviderAccount;
    private toPublicProviderLogin;
    private toFlexModelOptions;
    private aggregateFlexModelOptions;
    private consumePendingFlexFinishedPrompt;
    private registerFlexRun;
    private unregisterFlexRun;
    private activeFlexRunAuthority;
    private activeFlexRunAuthorityForSessionGeneration;
    private assertActiveFlexRunAuthority;
    private flexDelegationPermissionKey;
    private flexDelegationContextKey;
    private flexDelegatedRunKey;
    private flexDelegatedSessionKey;
    private requireFlexDelegatedRunLeaseIssuer;
    private flexDelegatedRunLeaseTag;
    private issueFlexDelegatedRunLeaseId;
    private ownsFlexDelegatedRunLeaseReceipt;
    private createFlexDelegationTicket;
    private activateFlexDelegationTicket;
    private revokeFlexDelegationTicket;
    private consumeFlexDelegationTicket;
    private markFlexDelegatedRunLeaseClosed;
    private settleFlexDelegatedRunLease;
    private cleanupFlexDelegatedRunLease;
    private clearFlexDelegatedAuthority;
    private fenceFlexDelegatedAuthority;
    private fenceFlexDelegatedAuthorityForParent;
    private fenceFlexDelegatedAuthorityForParentScope;
    private acquireFlexDelegatedRunAdmission;
    private closeFlexDelegatedRunAdmission;
    private activeFlexDelegatedRunLease;
    private flexPermissionAuthority;
    private flexPermissionAuthoritiesEqual;
    private flexPermissionAuthorityIsCurrent;
    private assertFlexPermissionAuthority;
    private flexSubagentPermissionMetadata;
    private prepareFlexDelegationTicket;
    private respondToFlexPermission;
    private ownsFlexRun;
    private ownsManagedOrDelegatedFlexRun;
    private retireFlexRun;
    private retryFlexRunCleanup;
    private retryPendingFlexRunCleanups;
    private retryFlexGlobalCleanup;
    private drainFlexGlobalCleanup;
    private queueFlexGlobalCleanup;
    private scheduleFlexRunCleanupRetry;
    private fenceFlexRunAuthority;
    private acknowledgeFlexRun;
    private handleHarnessOperationReleased;
    private queueOpenCodePromptIfBlocked;
    private openCodePromptQueueCanDispatch;
    private scheduleQueuedOpenCodePrompt;
    private waitForOpenCodePromptQueueDrains;
    private dispatchQueuedOpenCodePrompt;
    private acquireOpenCodePromptQueueFence;
    private pendingPromptsForSession;
    private queueHarnessPromptChanged;
    private releaseOpenCodeOperationsAfterSessionError;
    private startOpenCodeOperationMonitor;
    private reconcileOpenCodeOperations;
    private handleOpenCodeMessageLifecycle;
    private failClosedOpenCodeHarness;
    private queueHarnessSessionErrors;
    private handleHarnessChildExit;
    private handleOpenCodeChildExitObserved;
    private handleFlexChildExitObserved;
    private handleFlexChildExit;
    private handleUndeliveredFlexHostSuccess;
    private resolveFlexHostAuthorityTarget;
    private flexHostRequestGeneration;
    private flexDelegatedHostCleanupOnly;
    private flexDelegationTicketForProjectManagement;
    private resolveFlexDelegatedHostAuthority;
    private assertFlexDelegatedHostAuthority;
    private flexHostMethodAllowsCleanup;
    private reserveFlexProjectHostRequestAdmission;
    private assertFlexHostAuthority;
    private handleFlexHostRequest;
    private handleAuthorizedFlexHostRequest;
    private queueHarnessSessionError;
    private consumePendingFlexFinishedJob;
    private handleFlexEvent;
    private handleAuthorizedFlexDelegatedEvent;
    private flexEventGenerationIsManaged;
    private handleAuthorizedFlexEvent;
    private getFlexToolStreamCursor;
    private prepareCoreMessagePageForLiveSnapshots;
    private boundLiveSnapshotsForCorePage;
    private getFlexMessageStreamCursor;
    private flexCorePageRepresentsToolExecution;
    private flexCorePageRepresentsReasoningUpdate;
    private flexCorePageRepresentsTextUpdate;
    private retireCoveredFlexSnapshots;
    private deleteLatestFlexToolExecution;
    private deleteLatestFlexReasoningUpdate;
    private deleteLatestFlexTextUpdate;
    private setLatestFlexToolExecution;
    private setLatestFlexReasoningUpdate;
    private setLatestFlexTextUpdate;
    private flexControllerEventLiveBytes;
    private deletePendingFlexControllerEvent;
    private setPendingFlexControllerEvent;
    private clearPendingFlexControllerEvents;
    private flexSnapshotsForSession;
    private flexToolExecutionsForSession;
    private flexReasoningUpdatesForSession;
    private flexTextUpdatesForSession;
    private advanceFlexToolStreamEpoch;
    private advanceFlexMessageStreamEpoch;
    private advanceFlexStreams;
    private purgeFlexToolExecutionsForSession;
    private purgeOpenCodeStreamStateForSession;
    private purgeOpenCodeStreamStateForProject;
    private purgeFlexToolExecutionsForProject;
    private handleFlexToolExecution;
    private handleFlexReasoningUpdate;
    private handleFlexTextUpdate;
    private handleFlexPartDelta;
    private getOpenCodeToolStreamCursor;
    private getOpenCodeMessageStreamCursor;
    private openCodeToolExecutionKey;
    private flexEventCacheKey;
    private openCodeToolExecutionsForSession;
    private openCodeReasoningUpdatesForSession;
    private openCodeTextUpdatesForSession;
    private advanceOpenCodeToolStreamEpoch;
    private advanceOpenCodeMessageStreamEpoch;
    private advanceOpenCodeStreams;
    private handleOpenCodeReasoningUpdate;
    private handleOpenCodeTextUpdate;
    private handleOpenCodeMessageUpdate;
    private handleOpenCodeToolExecution;
    private controllerEventKey;
    private latestPendingControllerDelta;
    private queueOpenCodeControllerEvent;
    private startOpenCodeControllerEventDrain;
    private drainOpenCodeControllerEvents;
    private rebaseFlexLiveControllerEvent;
    private queueFlexControllerEvent;
    private startFlexControllerEventDrain;
    private drainFlexControllerEvents;
    private queueFlexAutoAcceptSweep;
    private startFlexAutoAcceptDrain;
    private drainFlexAutoAcceptSweeps;
    private autoAcceptFlexPendingPermissions;
    private isProjectAutoAcceptedSession;
    private hasFlexYoloSessions;
    private projectRuntimeIdKey;
    private unusedSessionKey;
    private trimUnusedSessionStates;
    private markUnusedSession;
    private claimUnusedSession;
    private discardUnusedSession;
    private isConfirmedArchivedSession;
    private isConfirmedOpenCodeArchive;
    private readArchivePreflight;
    private readMutableHarnessSession;
    private requireOpenCodeArchiveRuntime;
    private requireFlexArchiveRuntime;
    private waitForArchiveRetryOrRuntimeExit;
    private waitForArchiveRuntimeExit;
    private waitForOpenCodeArchiveMutationOrRuntimeExit;
    private reconcileUnknownOpenCodeArchive;
    private retainUnknownOpenCodeArchive;
    private reconcileUnknownFlexArchive;
    private retainFlexArchiveFenceUntilRuntimeExit;
    private finalizeArchivedSession;
    private invalidateHarnessSessionEnumeration;
    private archiveSession;
    private deleteSession;
    private beginManagedSessionDeletion;
    private assertManagedDeletionProviderGenerationCurrent;
    private readonly autoAcceptSweepTimers;
    private readonly autoAcceptSweepTasks;
    private readonly autoAcceptSweepReplayDirectories;
    private drainAutoAcceptSweepTasksForShutdown;
    /**
     * Collapses permission-event bursts into one sweep per directory: every
     * auto-reply itself emits permission events, so sweeping per event goes
     * quadratic under load.
     */
    private scheduleAutoAcceptSweep;
    private autoAcceptPendingPermissions;
    private openCodeAutoAcceptSweepCanRun;
    private performAutoAcceptPendingPermissions;
    private pruneSessionFromLayout;
    /**
     * Serializes every write to the one controller-wide layout document. The queue is shared by
     * all projects because the document is.
     */
    private runSessionLayoutOperation;
    /** The layout is controller-wide, so its change event names no project. */
    private pushSessionLayoutChanged;
    private layoutSessionIdsByProject;
    /**
     * Three outcomes, because the layout must treat two of them differently.
     *
     * A project that is retiring or deregistered owns no layout rows any more: keeping them would
     * leave rows the sidebar can never resolve again. A registered project whose directory is
     * merely unavailable — unmounted, renamed, not yet attached — comes back, and its remembered
     * positions have to survive that, so its rows are kept and only withheld until it returns.
     * `resolveProject` maps both onto `project_not_found` for every other caller, which is why
     * the two halves are asked separately here rather than being told apart from its error.
     */
    private resolveLayoutProjectAvailability;
    /**
     * Rows of a withheld project stay stored; a client that cannot resolve them never sees them.
     * The revision is deliberately untouched, so the withholding is invisible to optimistic
     * concurrency and the rows reappear at their stored positions once the directory is back.
     */
    private withoutLayoutProjects;
    /**
     * A layout update is a full replacement, and a client can only replace what it was shown, so
     * the rows withheld while a project directory is unavailable are put back at their stored
     * positions. Without this the withholding would merely delay the deletion it prevents.
     */
    private retainWithheldLayoutItemRefs;
    private pushResourceChanged;
    private openBrowserView;
    private activateBrowserView;
    private activateBrowserViewTransport;
    private recoverBrowserView;
    private closeBrowserView;
    private closeBrowserViewsForPeer;
    /**
     * Closes the views a resource owns before its runtime is torn down or moved
     * under them, announcing why. The browser host calls this for every such
     * teardown. `view_closed` is for a resource on its way down, so the client
     * must not reopen from a resource list that has not caught up yet;
     * `resource_changed` is for a resource that stays available under a new
     * attachment, which the client reopens once its list refreshes.
     */
    private closeBrowserViewsForResource;
    private runBrowserViewSlotOperation;
    private enqueueBrowserViewSlotOperation;
    private markBrowserViewClosing;
    private scheduleBrowserViewClose;
    private armBrowserViewRenewal;
    private renewBrowserViewAuthority;
    /**
     * Announces a controller-initiated close on the event stream before the
     * streams are aborted, so the client can tell an intentional close from a
     * transport fault and never spends a recovery attempt on it. The caller says
     * what kind of close it is; see the close codes for what each one asks of
     * the client. The view is fenced as failing at once; returns the delivery,
     * or undefined when nothing can be announced. The close proceeds either way.
     */
    private announceBrowserViewClose;
    /**
     * Says so when a close the controller made itself could not be announced.
     * The close proceeds either way, but the client will read the stream reset
     * that follows as a transport fault and spend its recovery budget on it, so
     * the reason belongs in the log rather than nowhere.
     */
    private reportUnannouncedBrowserViewClose;
    private reportBrowserDeliveryFailure;
    /** Announces the close when possible, waits a bounded time for delivery, then cleans up. */
    private closeBrowserViewAnnounced;
    private requestBrowserViewCleanup;
    private cleanupBrowserViewAsSlotOwner;
    private attemptBrowserViewCleanup;
    private scheduleBrowserViewCleanupRetry;
    private queueBrowserViewEvent;
    private createBrowserViewTransport;
    private beginBrowserViewTransportOpening;
    private openBrowserViewTransport;
    private receiveBrowserOperations;
    private admitBrowserClientPacket;
    private browserOperationsCanCoalesce;
    private cancelBrowserOperation;
    private admitBrowserOperations;
    private runQueuedBrowserOperation;
    private runBrowserOperation;
    private isBrowserSemanticOperation;
    private isBrowserRawInputOperation;
    private assertBrowserViewLiveAuthority;
    private assertHumanBrowserLiveAuthority;
    private executeBrowserOperation;
    private settleBrowserOperation;
    private queueBrowserOperationResult;
    /** Reliable control and signaling packets retain FIFO order with reserved close capacity. */
    private queueBrowserServerPacket;
    private ensureBrowserEventDrain;
    private browserTransportCanDeliverPacket;
    /**
     * Tears down an event stream, and is the only place allowed to: a stream
     * that carried an announced close is ended in order behind it, because a
     * reset discards the very packet that tells the client the close was
     * intentional and leaves it reading an unexplained stream failure. Ending
     * is asynchronous, so callers that tear the transport down around it must
     * await the returned promise rather than race it. Everything else is reset,
     * because nothing is owed on it.
     */
    private retireBrowserEventStream;
    private failBrowserTransportProtocol;
    private noteBrowserTransportFault;
    private terminalizeBrowserTransportOperations;
    private armBrowserViewRecoveryDeadline;
    private retireBrowserViewTransport;
    private waitForBrowserTransportSettlement;
    private browserOperationError;
    private closeBrowserDevTools;
    private openBrowserDevTools;
    private bindBrowserDevToolsAuthorization;
    private bindBrowserStreamAuthorization;
    private revalidateBrowserStream;
    private isBrowserStreamBindingAuthorityCurrent;
    private isBrowserViewInMemoryAuthorityCurrent;
    private assertBrowserViewAuthority;
    private isBrowserRuntimeAuthorityCurrent;
    private nextControllerBrowserViewState;
    private resolveAttentionRootSessionIds;
    private sweepAutoAcceptAcrossProjects;
    private resolveProject;
    private resolveProjectIdentity;
    private assertProjectDirectory;
    private resolveAvailableProjects;
    private toPublicProject;
    private resolveExistingProjectDirectory;
    /**
     * Display name for a registered directory: relative when it lives under the
     * projects root, else the absolute path itself.
     */
    private deriveProjectName;
    private listProjectPathSuggestions;
    private sendTerminalOutput;
    /**
     * Best effort by construction: it rides the same transport whose failure usually produced the
     * detach, so failures are swallowed and the browser also recovers from an output gap or an
     * explicit re-selection.
     */
    private sendTerminalDetached;
    private pushControllerEvent;
    private runUpgradePreparationAdmission;
    private upgradePreparationReplayIsAccepted;
    private createUpgradePreparationContext;
    private persistUpgradePreparation;
    private pushUpgradePreparationEvent;
    private completeUpgradePreparation;
    private clearUpgradePreparationAbortController;
    private compensateUpgradePreparationFailure;
    private prepareUpgrade;
    private beginUpgradePreparation;
    private abortAndWaitForUpgradePreparation;
    private finalizeUpgrade;
    private sendUpgradeControlPrompt;
    private retainUpgradeOwnership;
    private releaseRetainedUpgradeOwnership;
    private startUpgradeWorkerWatchdog;
    private pushSessionDraftChanged;
    private isHarnessSubmissionOutcomeUnknown;
    private isFlexPromptAdmissionTerminated;
    private assertStartActive;
    private runOperation;
    private runPrincipalOperation;
    private assertControllerOperationPrincipal;
    private auditPeerId;
    private abortBusySessionsBeforeExit;
    private mintResumeToken;
    private consumeResumeToken;
    private recordProtectedOperation;
    private recordUnauthenticatedAuditOperation;
    private recordUnauthenticatedPreflightOperation;
    private trackOperationPromise;
    private waitForActiveOperations;
    private waitForOwnedProcessGroupChildren;
    private requireRuntimeConfig;
    private requireAuthStore;
    private requireTypedServer;
    private requirePasskeyManager;
    private requireOpenCodeClient;
    private requireFlexSupervisor;
    private requireFlexProjectionReader;
    private requireGitReversion;
    private resolveFlexHostGitProject;
    private terminalPeerLifecycle;
    private requireTerminalManager;
    private requireResourceCoordinator;
    private requireBrowserResourceHost;
}