/**
 * Dashboard environment handler for the orchestrator.
 *
 * Responds to dashboard.environments.* and dashboard.held-runs.* WS messages
 * from Platform by calling the appropriate stores (EnvironmentStore, VariableStore,
 * BindingStore, PgSecretStore) and sending typed responses.
 *
 * Each handler:
 * 1. Extracts orgId from the dependency context
 * 2. Calls the appropriate store method
 * 3. Returns a response message with requestId and data (or error)
 */
import { type Kysely } from 'kysely';
import type { DashboardPlatformToOrchMessage } from '@kici-dev/engine';
import type { EnvironmentStore } from '../environments/environment-store.js';
import type { VariableStore } from '../environments/variable-store.js';
import type { BindingStore } from '../environments/binding-store.js';
import type { Database } from '../db/types.js';
import type { AccessLogWriter } from '../audit/access-log.js';
/** Secret store interface (subset of PgSecretStore methods used here). */
interface SecretStoreForDashboard {
    listScopes(orgId: string): Promise<string[]>;
    listKeys(orgId: string, scope: string): Promise<string[]>;
    setSecret(orgId: string, scope: string, key: string, value: string): Promise<void>;
    deleteSecret(orgId: string, scope: string, key: string): Promise<void>;
    createScope?(orgId: string, scope: string): Promise<void>;
    renameScope?(orgId: string, oldScope: string, newScope: string): Promise<void>;
    deleteScope?(orgId: string, scope: string): Promise<void>;
}
export interface DashboardEnvHandlerDeps {
    /** Organization ID for all operations. */
    orgId: string;
    /** Send a response message back to Platform over the WS connection. */
    send: (msg: unknown) => void;
    environmentStore: EnvironmentStore;
    variableStore: VariableStore;
    bindingStore: BindingStore;
    secretStore: SecretStoreForDashboard;
    /** Load fresh backend stores from registry (creates new store instances with current credentials). */
    loadBackendStores?: () => Promise<Map<string, SecretStoreForDashboard>>;
    /** Database for held_runs queries. */
    db: Kysely<Database>;
    /** Access log writer — records one row per read / mutation with actor attribution. */
    accessLog?: AccessLogWriter;
    /** Routing key for access_log rows (null when not run-scoped). */
    routingKey?: string | null;
}
/**
 * Handler for all dashboard environment and held run WS messages.
 *
 * Dispatches incoming messages by type and calls the appropriate store.
 */
export declare class DashboardEnvHandler {
    private readonly deps;
    private routingKey;
    private readonly accessLog;
    constructor(deps: DashboardEnvHandlerDeps);
    /** Update the orgId used for all operations (called when resolved from DB). */
    setOrgId(orgId: string): void;
    /** Update the routing key bound to access_log rows. */
    setRoutingKey(routingKey: string | null): void;
    /**
     * Defense-in-depth dashboard-write policy gate. Returns true when the
     * operation is allowed and the caller should proceed. Returns false when
     * the policy is disabled — also records a `denied` access_log row and
     * sends a structured `operation_disabled` envelope back to Platform.
     */
    private enforcePolicy;
    /**
     * Write an access_log row for a handler invocation. Uses the handler's
     * bound orgId + routingKey, the msg.actor principal, and the handler-
     * specified action + target. Best-effort; the writer swallows failures.
     */
    private recordAccess;
    /**
     * Route a dashboard message to the appropriate handler.
     * Returns true if the message was handled, false otherwise.
     */
    handleMessage(msg: DashboardPlatformToOrchMessage): Promise<boolean>;
    private handleEnvList;
    private handleEnvGet;
    private handleEnvCreate;
    private handleEnvUpdate;
    private handleTestAccessSet;
    private handleEnvDelete;
    private handleVarsList;
    private handleVarSet;
    private handleVarDelete;
    private handleSourceOverridesList;
    private handleSourceOverrideSet;
    private handleSourceOverrideDelete;
    private handleBindingsList;
    private handleBindingsSet;
    /** Load fresh backend stores, falling back to single secretStore wrapped in a Map. */
    private getBackendStores;
    /**
     * Resolve the correct backend store for a prefixed scope (e.g., 'vault:aws/prod').
     * Returns the store and the scope to pass to it.
     * All stores expect unprefixed scopes — the backend prefix is stripped.
     */
    private resolveStoreForScope;
    private handleSecretsList;
    private handleSecretSet;
    private handleSecretDelete;
    private handleScopeCreate;
    private handleScopeRename;
    private handleScopeDelete;
    private handleEnvHistory;
    private handleHeldRunsList;
    private handleHeldRunApprove;
    private handleHeldRunReject;
    private sendError;
}
export {};
//# sourceMappingURL=dashboard-env-handler.d.ts.map