/**
 * Join handler for processing join requests from new orchestrators.
 *
 * Supports both Platform relay and direct peer transport. When a new orchestrator
 * sends a join.request with a kici_join_v1 token, this handler:
 * 1. Validates the token (exists in DB, not expired, not consumed)
 * 2. Builds a config bundle (DB URL, S3 config, secrets key, cluster ID)
 * 3. Encrypts the bundle with the token-derived AES-256-GCM key
 * 4. Consumes the token (one-time use)
 * 5. Returns the encrypted bundle to the joiner
 *
 * The Platform relay sees only routing metadata and ciphertext -- zero-knowledge.
 */
import type { JoinRequest, JoinResponse } from '@kici-dev/engine';
import type { Kysely } from 'kysely';
import type { ClusterIdentity } from './cluster-identity.js';
import type { SharedConfigStore } from '../config/shared-store.js';
interface JoinHandlerDeps {
    db: Kysely<any>;
    sharedConfigStore: SharedConfigStore;
    clusterIdentity: ClusterIdentity;
    databaseUrl: string;
}
/**
 * Config bundle distributed to new orchestrators via join token.
 * Contains everything needed to configure and start an orchestrator instance.
 */
export interface ConfigBundle {
    databaseUrl: string;
    storage?: {
        type?: 's3';
        bucket?: string;
        prefix?: string;
        region?: string;
        endpoint?: string;
        forcePathStyle?: boolean;
        logBucket?: string;
    };
    secretKey?: string;
    clusterId: string;
}
export declare class JoinHandler {
    private readonly deps;
    private readonly tokenManager;
    constructor(deps: JoinHandlerDeps);
    /**
     * Handle a join request from a new orchestrator.
     * Validates token, builds config bundle, encrypts with token-derived key, consumes token.
     * Echoes messageId from request for Platform relay correlation.
     */
    handleJoinRequest(request: JoinRequest): Promise<JoinResponse>;
    /**
     * Build the config bundle from SharedConfig + local config.
     */
    buildConfigBundle(): Promise<ConfigBundle>;
}
export {};
//# sourceMappingURL=join-handler.d.ts.map