/**
 * Admin API routes for secrets management.
 *
 * Provides CRUD endpoints for contexts, secrets, tokens, audit log queries,
 * and key rotation. All routes are protected by Bearer token authentication
 * and RBAC permission checks.
 *
 * Secret values are write-only -- there is deliberately no "get secret value"
 * endpoint. Values are only read during dispatch resolution.
 */
import { Hono } from 'hono';
import type { TokenManager } from '../secrets/token-manager.js';
import type { RbacEnforcer, Role } from '../secrets/rbac.js';
import type { PgSecretStore } from '../secrets/pg-secret-store.js';
import type { AuditLogger } from '../secrets/audit-logger.js';
import type { AgentTokenStore } from '../agent/token-store.js';
import type { AgentRegistry } from '../agent/registry.js';
import type { SharedConfigStore } from '../config/shared-store.js';
import type { SourceStore } from '../sources/source-store.js';
import type { JoinTokenManager } from '../cluster/join-token.js';
import type { BackendRegistry } from '../secrets/backend-registry.js';
import type { BackendHealthChecker } from '../secrets/backend-health.js';
import type { BackendSyncManager } from '@kici-dev/engine';
import type { Kysely } from 'kysely';
import type pg from 'pg';
import type { AccessLogWriter } from '../audit/access-log.js';
/**
 * Dependencies for admin API routes.
 */
export interface AdminRouteDeps {
    tokenManager: TokenManager;
    rbac: RbacEnforcer;
    secretStore: PgSecretStore;
    auditLogger: AuditLogger;
    /** Optional -- for agent token CRUD endpoints. */
    tokenStore?: AgentTokenStore;
    /**
     * Optional -- for kicking in-flight agent WS on token revoke.
     *
     * The DELETE /api/v1/agent-tokens/:id route calls
     * `agentRegistry.disconnectByTokenId(id)` synchronously after
     * `tokenStore.revoke(id)` so a revoked token loses data-plane
     * authority immediately instead of staying live until the agent
     * itself disconnects. Mirrors the fix on the orch->Platform
     * leg (`disconnectByKeyId`).
     *
     * When unset, the DELETE route returns 503 — agent-token revoke is
     * meaningless without the kick path because a revoked token would
     * still grant in-flight authority for hours-to-days.
     */
    agentRegistry?: AgentRegistry;
    /**
     * Optional -- fan out the revoke to every peer in a clustered orchestrator.
     *
     * The DELETE /api/v1/agent-tokens/:id route calls this after the synchronous
     * local kick, so every peer's `AgentRegistry.disconnectByTokenId(tokenId)`
     * runs locally and closes its own in-flight WS for the same token. Mirrors
     *'s Valkey fan-out pattern on the orch->Platform leg.
     *
     * Unset on standalone deployments (no peer fabric) -- the local kick alone
     * is sufficient there.
     */
    broadcastAgentTokenRevoke?: (tokenId: string) => void;
    /** Optional -- for source management endpoints. */
    sourceStore?: SourceStore;
    /**
     * Optional -- resolves the public webhook URL for a newly added source so
     * `kici-admin source add` can print it. Wired in platform/hybrid mode to
     * register-and-await the Platform ack; independent mode returns a null URL
     * with a note.
     */
    resolveSourceWebhookUrl?: (params: {
        routingKey: string;
        provider: string;
        sourceId: string;
    }) => Promise<{
        webhookUrl: string | null;
        webhookNote?: string;
    }>;
    /** Optional -- for DB migration endpoints. */
    db?: Kysely<any>;
    /** Optional -- for DB migration endpoints. */
    pool?: pg.Pool;
    /** Optional -- for cluster join token creation. */
    joinTokenManager?: JoinTokenManager;
    /** Optional -- for secret backend management endpoints. */
    backendRegistry?: BackendRegistry;
    /** Optional -- for secret backend health checking. */
    backendHealthChecker?: BackendHealthChecker;
    /** Optional -- for secret backend scope sync. */
    backendSyncManager?: BackendSyncManager;
    /**
     * Optional -- for `POST /api/v1/admin/rotate-key`.
     *
     * When set, `rotate-key` re-encrypts `config_versions` alongside
     * `scoped_secrets` in two sequential transactions. When unset (e.g. a
     * secret-store-only admin deployment), config rotation is skipped and the
     * response reports `reEncryptedConfigs: 0`.
     */
    sharedStore?: SharedConfigStore;
    /**
     * Optional -- attribution writer for routes that emit an `access_log`
     * row directly (today: org-settings dashboard-write policy flips). When
     * unset, those routes execute the mutation without recording — the
     * write is best-effort, never gating.
     */
    accessLog?: AccessLogWriter;
}
/** Hono env type for admin routes with context variables. */
type AdminEnv = {
    Variables: {
        role: Role;
        userId: string;
        routingKey: string | null;
    };
};
/**
 * Create admin API routes with Bearer token authentication and RBAC.
 *
 * @param deps - Admin route dependencies (token manager, RBAC, secret store, audit logger, etc.)
 * @returns Hono app with admin routes mounted at /api/v1/admin/*
 */
export declare function createAdminRoutes(deps: AdminRouteDeps): Hono<AdminEnv>;
export {};
//# sourceMappingURL=admin.d.ts.map