/**
 * HTTP client wrapper for the kici-admin CLI.
 *
 * Communicates with the orchestrator admin API via Bearer token authentication.
 * All methods are thin wrappers around fetch() that handle JSON serialization,
 * error formatting, and URL construction.
 */
/**
 * Universal-git configuration shape carried in `git_config` on
 * generic_webhook_sources. Matches `UniversalGitConfigSchema` in
 * `providers/universal-git/config.ts`. Kept as a loose `Record` here to
 * avoid a cross-package import in the CLI wire type.
 */
export type GenericSourceGitConfigPayload = Record<string, unknown>;
/**
 * Response shape for generic webhook sources from the admin API.
 */
export interface GenericSourceResponse {
    id: string;
    customer_id: string;
    name: string;
    routing_key: string;
    verification_method: string;
    verification_config: string;
    event_type_header: string | null;
    event_type_path: string | null;
    idempotency_key_header: string | null;
    idempotency_key_path: string | null;
    dedup_window_seconds: number;
    max_payload_bytes: number;
    allowed_events: string | null;
    strip_headers: string;
    enabled: boolean;
    rate_limit_rpm: number;
    created_at: string;
    updated_at: string;
    deleted_at: string | null;
    provider_type?: string;
    /** Universal-git config; raw JSON string or parsed object (pg driver dependent). */
    git_config?: string | GenericSourceGitConfigPayload | null;
}
export declare class AdminApiClient {
    private readonly baseUrl;
    private readonly token;
    constructor(baseUrl: string, token: string);
    /**
     * Make an authenticated HTTP request to the admin API.
     */
    private request;
    /**
     * Public GET request returning parsed JSON.
     */
    get<T>(path: string): Promise<T>;
    /**
     * Public POST request returning parsed JSON.
     */
    post<T>(path: string, body: unknown): Promise<T>;
    /**
     * Public PATCH request returning parsed JSON.
     */
    patch<T>(path: string, body: unknown): Promise<T>;
    /**
     * Public PUT request returning parsed JSON.
     */
    put<T>(path: string, body: unknown): Promise<T>;
    /**
     * Public DELETE request returning parsed JSON.
     */
    delete<T>(path: string): Promise<T>;
    /**
     * Public GET request returning raw response text.
     */
    getText(path: string): Promise<string>;
    listScopes(orgId: string): Promise<{
        scopes: string[];
    }>;
    listKeys(orgId: string, scope: string): Promise<{
        keys: string[];
    }>;
    setSecret(orgId: string, scope: string, key: string, value: string): Promise<void>;
    deleteSecret(orgId: string, scope: string, key: string): Promise<void>;
    listVariables(orgId: string, environment: string): Promise<{
        variables: Array<{
            key: string;
            value: string;
            locked: boolean;
            updated_at: string;
        }>;
    }>;
    setVariable(orgId: string, environment: string, key: string, value: string, locked?: boolean): Promise<void>;
    deleteVariable(orgId: string, environment: string, key: string): Promise<void>;
    rotateKey(): Promise<{
        reEncrypted: number;
        reEncryptedConfigs: number;
        skippedConfigs: number;
    }>;
    createGenericSource(data: {
        orgId: string;
        name: string;
        verificationMethod?: string;
        verificationConfig?: Record<string, unknown>;
        eventTypeHeader?: string;
        eventTypePath?: string;
        idempotencyKeyHeader?: string;
        idempotencyKeyPath?: string;
        dedupWindowSeconds?: number;
        maxPayloadBytes?: number;
        allowedEvents?: string[];
        stripHeaders?: string[];
        rateLimitRpm?: number;
        providerType?: string;
        gitConfig?: GenericSourceGitConfigPayload;
    }): Promise<{
        source: GenericSourceResponse;
    }>;
    listGenericSources(orgId: string, includeDeleted?: boolean): Promise<{
        sources: GenericSourceResponse[];
    }>;
    getGenericSource(id: string): Promise<{
        source: GenericSourceResponse;
    }>;
    updateGenericSource(id: string, data: {
        name?: string;
        verificationMethod?: string;
        verificationConfig?: Record<string, unknown>;
        eventTypeHeader?: string;
        eventTypePath?: string;
        idempotencyKeyHeader?: string;
        idempotencyKeyPath?: string;
        dedupWindowSeconds?: number;
        maxPayloadBytes?: number;
        allowedEvents?: string[];
        stripHeaders?: string[];
        rateLimitRpm?: number;
        providerType?: string;
        /** `null` clears the config; omit to leave unchanged. */
        gitConfig?: GenericSourceGitConfigPayload | null;
    }): Promise<{
        source: GenericSourceResponse;
    }>;
    deleteGenericSource(id: string, hard?: boolean): Promise<{
        deleted: boolean;
        hard: boolean;
    }>;
    enableGenericSource(id: string): Promise<{
        enabled: boolean;
    }>;
    disableGenericSource(id: string): Promise<{
        enabled: boolean;
    }>;
    queryAudit(opts?: {
        contextName?: string;
        routingKey?: string;
        action?: string;
        from?: string;
        to?: string;
        limit?: number;
        offset?: number;
        /** Phase D opt-in for cold-store read-through. */
        includeArchived?: boolean;
    }): Promise<any[]>;
    createToken(data: {
        label: string;
        role: string;
        routingKey?: string;
    }): Promise<{
        token: string;
        id: string;
    }>;
    listTokens(): Promise<any[]>;
    revokeToken(id: string): Promise<void>;
    createAgentToken(opts: {
        labels?: string[];
    }): Promise<{
        id: string;
        token: string;
    }>;
    listAgentTokens(opts?: {
        type?: string;
    }): Promise<{
        tokens: any[];
    }>;
    /**
     * Revoke an agent token.
     *
     * The orchestrator both flips `agent_tokens.revoked_at` AND
     * synchronously closes every in-flight agent WS authenticated by
     * this token. The returned `kicked` count is the number
     * of WS connections that were closed on the wire — surface it to
     * the operator so they know the revocation actually propagated.
     */
    revokeAgentToken(id: string): Promise<{
        kicked: number;
    }>;
    configSeed(config: object, description?: string): Promise<{
        version: number;
    }>;
    configGet(path?: string): Promise<{
        config: unknown;
        version: number;
        source: string;
    }>;
    configSet(path: string, value: unknown, description?: string): Promise<{
        version: number;
    }>;
    configDelete(path: string, description?: string): Promise<{
        version: number;
    }>;
    configExport(): Promise<{
        config: object;
        version: number;
    }>;
    configValidate(config: object, type?: string): Promise<{
        valid: boolean;
        errors?: any[];
    }>;
    configDiff(): Promise<{
        local: object;
        shared: object;
        differences: any[];
    }>;
    configHistory(limit?: number): Promise<{
        versions: any[];
    }>;
    configRollback(version: number): Promise<{
        newVersion: number;
    }>;
    configReload(opts?: {
        drain?: boolean;
        target?: string;
    }): Promise<{
        success: boolean;
        version?: number;
        errors?: string[];
    }>;
    createApiKey(opts: {
        label?: string;
        routingKeys?: string[];
    }): Promise<{
        id: string;
        key: string;
        routingKeys: string[];
    }>;
    addRoutingKeyPermission(keyId: string, pattern: string): Promise<{
        id: string;
        pattern: string;
    }>;
    addBackend(params: {
        name: string;
        backendType: string;
        config: Record<string, unknown>;
        scopeFilter?: string;
        syncIntervalMs?: number;
    }): Promise<Record<string, unknown>>;
    removeBackend(name: string): Promise<{
        removed: boolean;
        scopeCount: number;
    }>;
    listBackends(): Promise<{
        backends: Record<string, unknown>[];
    }>;
    getBackend(name: string): Promise<Record<string, unknown>>;
    testBackend(params: {
        name: string;
        backendType: string;
        config: Record<string, unknown>;
        scopeFilter?: string;
        syncIntervalMs?: number;
    }): Promise<{
        ok: boolean;
        error?: string;
        latencyMs: number;
    }>;
    testNamedBackend(name: string): Promise<{
        ok: boolean;
        error?: string;
        latencyMs: number;
    }>;
    syncBackend(name: string): Promise<{
        synced: boolean;
        scopeCount: number;
    }>;
    syncAllBackends(): Promise<{
        results: Array<{
            name: string;
            scopeCount: number;
            error?: string;
        }>;
    }>;
    /**
     * List execution runs. `status` accepts either a single status or a
     * comma-separated list (e.g. `success,failed`). `since` is an ISO-8601
     * timestamp; only runs with `created_at` strictly later than this value
     * are returned.
     */
    listRuns(opts?: {
        status?: string;
        workflowName?: string;
        repo?: string;
        since?: string;
        limit?: number;
        offset?: number;
    }): Promise<{
        runs: Array<Record<string, unknown>>;
        total: number;
        limit: number;
        offset: number;
    }>;
    /**
     * Count matching runs without returning the row list. Wraps the list
     * endpoint with `?count=true`, which skips the row query server-side.
     */
    countRuns(opts?: {
        status?: string;
        workflowName?: string;
        repo?: string;
        since?: string;
    }): Promise<{
        total: number;
        since: string | null;
        status: string[] | null;
        workflowName: string | null;
        repo: string | null;
    }>;
    /**
     * Fetch the run header (no jobs, no steps). Use `getRunJobs` for the
     * jobs sub-resource.
     */
    getRun(runId: string): Promise<{
        run: Record<string, unknown>;
    }>;
    /**
     * Fetch the jobs list for a run. When `includeSteps: true`, each job
     * entry embeds a `steps[]` array.
     */
    getRunJobs(runId: string, opts?: {
        includeSteps?: boolean;
    }): Promise<{
        jobs: Array<Record<string, unknown>>;
    }>;
    /**
     * Fetch the scrub status of the run's ephemeral key. Never returns the
     * key material itself — only `{ exists, createdAt }`.
     */
    getRunEphemeralKey(runId: string): Promise<{
        exists: boolean;
        createdAt: string | null;
    }>;
    /**
     * List secret outputs for a run. Values are masked unless `reveal: true`
     * is passed AND the calling token has the `secret.reveal` permission.
     * Every reveal call writes a `secret-outputs.reveal` row to the
     * secret_audit_log table.
     */
    getRunSecretOutputs(runId: string, opts?: {
        outputKey?: string;
        reveal?: boolean;
    }): Promise<{
        outputs: Array<{
            id: string;
            jobId: string;
            outputKey: string;
            createdAt: string;
            value: string | null;
            masked: boolean;
            revealError?: string;
        }>;
    }>;
    listEventLog(opts?: {
        orgId?: string;
        routingKey?: string;
        event?: string;
        action?: string;
        status?: string;
        from?: string;
        to?: string;
        deliveryId?: string;
        limit?: number;
        offset?: number;
        includeArchived?: boolean;
    }): Promise<{
        deliveries: Array<Record<string, unknown>>;
        total: number;
        limit: number;
        offset: number;
    }>;
    getEventLog(deliveryId: string, opts: {
        orgId: string;
        includePayload?: boolean;
        routingKey?: string;
    }): Promise<Record<string, unknown>>;
    listAccessLog(opts?: {
        orgId?: string;
        actorType?: string;
        actorId?: string;
        action?: string;
        source?: string;
        outcome?: string;
        targetType?: string;
        targetId?: string;
        from?: string;
        to?: string;
        q?: string;
        limit?: number;
        cursor?: string;
    }): Promise<{
        items: Array<Record<string, unknown>>;
        nextCursor: string | null;
    }>;
    getAccessLogEntry(id: string, opts?: {
        orgId?: string;
    }): Promise<Record<string, unknown>>;
    diagnose(): Promise<{
        status: 'healthy' | 'degraded' | 'unhealthy';
        checks: Array<{
            name: string;
            status: 'pass' | 'warn' | 'fail';
            message: string;
            details?: Record<string, unknown>;
            durationMs: number;
        }>;
        timestamp: string;
    }>;
}
//# sourceMappingURL=api-client.d.ts.map