/**
 * Per-orchestrator policy controlling which dashboard.* write operations
 * the orch accepts from Platform.
 *
 * Storage: a JSONB column on the existing `org_settings` table, keyed by
 * `customer_id`. Empty object means every operation is enabled
 * (permissive default at first-boot). Operators flip individual
 * operations off via `kici-admin org-settings dashboard-writes set`.
 *
 * Three callers:
 *   - The kici-admin CLI mutates via `setDashboardWritePolicy`.
 *   - Mutating dashboard.* handlers check via `assertDashboardWriteAllowed`.
 *   - The Platform-bound WS publisher reads the full map via
 *     `getDashboardWritePolicy` to broadcast `orch.capabilities`.
 *
 * Reads are cached in-process (30 s TTL) — the policy changes
 * infrequently and reading on every dashboard.* request is wasted IO.
 * Writes invalidate the cache and emit a change event so the WS
 * broadcaster can republish.
 */
import { EventEmitter } from 'node:events';
import { type Kysely } from 'kysely';
import { DashboardWriteOperation, type DashboardWritePolicyMap } from '@kici-dev/engine/protocol/dashboard-write-operations';
import type { Database } from '../db/types.js';
import type { ActorPrincipal } from '@kici-dev/engine';
/**
 * Event bus for policy-change notifications. The WS publisher subscribes
 * to `'changed'` so it can broadcast a fresh `orch.capabilities` to
 * Platform whenever the operator flips a switch.
 */
export declare const dashboardWritePolicyEvents: EventEmitter<[never]>;
/**
 * Error thrown by `assertDashboardWriteAllowed` when an operation is
 * disabled. Carries the operation name + the descriptor's CLI hint so
 * callers can surface a structured error to Platform / dashboard.
 */
export declare class DashboardWritePolicyDisabledError extends Error {
    readonly operation: DashboardWriteOperation;
    readonly cliEquivalent: string;
    readonly code: "operation_disabled";
    constructor(operation: DashboardWriteOperation, cliEquivalent: string);
}
/**
 * Structured response envelope sent back to Platform when a mutating
 * dashboard.* handler is rejected by the policy gate. Mirrors the
 * Platform-side 403 body so the dashboard renders one consistent
 * "operation disabled" affordance no matter which layer fires first.
 */
export declare function buildPolicyDeniedResponse(op: DashboardWriteOperation, responseType: string, requestId: string): Record<string, unknown>;
/**
 * Clear the cache. Public for tests and for the rare case where an
 * operator wants to force a fresh read after manual DB surgery.
 */
export declare function invalidateDashboardWritePolicyCache(customerId?: string): void;
/**
 * Read the full policy map for a customer. Hits the in-process cache
 * for 30 s after the first read; falls back to the DB on cache miss.
 * Returns an empty map (everything enabled) when no `org_settings` row
 * exists for the customer.
 */
export declare function getDashboardWritePolicy(db: Kysely<Database>, customerId: string): Promise<DashboardWritePolicyMap>;
/**
 * Single-operation check. Convenience wrapper around
 * `getDashboardWritePolicy` + the engine-side resolver.
 */
export declare function isDashboardWriteEnabled(db: Kysely<Database>, customerId: string, op: DashboardWriteOperation): Promise<boolean>;
/**
 * Defense-in-depth gate for orch-side dashboard.* handlers. Throws
 * `DashboardWritePolicyDisabledError` when the operation is disabled.
 * Callers translate the error into the structured error envelope they
 * send back to Platform.
 */
export declare function assertDashboardWriteAllowed(db: Kysely<Database>, customerId: string, op: DashboardWriteOperation): Promise<void>;
/**
 * Merge `updates` into the persisted policy and persist the result.
 * Unknown keys in `updates` are rejected at the Zod schema layer
 * before this function runs (kici-admin already validates). Any
 * operation explicitly set to `true` is normalized away — the
 * permissive default lives in the absence of the key, keeping the
 * JSONB shape minimal.
 *
 * Each changed operation invokes the optional `onChange` callback
 * once — the caller decides what to do with it (typically: write
 * one `access_log` row per change).
 *
 * Emits `'changed'` on `dashboardWritePolicyEvents` with the new map
 * so the WS publisher can rebroadcast capabilities.
 */
export declare function setDashboardWritePolicy(db: Kysely<Database>, customerId: string, updates: DashboardWritePolicyMap, options: {
    actor: ActorPrincipal;
    onChange?: (event: PolicyChangeEvent) => Promise<void>;
}): Promise<DashboardWritePolicyMap>;
/**
 * Per-operation change event fired by `setDashboardWritePolicy` for
 * each switch that actually flipped. The caller (admin HTTP route,
 * test, future automation) decides what to do — typically writes one
 * `access_log` row carrying `op`, `prior`, and `next` in `meta`.
 */
export interface PolicyChangeEvent {
    actor: ActorPrincipal;
    customerId: string;
    op: DashboardWriteOperation;
    prior: boolean;
    next: boolean;
}
/**
 * Reset to the permissive defaults (everything enabled). Useful for
 * the `kici-admin org-settings dashboard-writes reset` subcommand.
 */
export declare function resetDashboardWritePolicy(db: Kysely<Database>, customerId: string, options: {
    actor: ActorPrincipal;
    onChange?: (event: PolicyChangeEvent) => Promise<void>;
}): Promise<DashboardWritePolicyMap>;
export { resolveFullPolicyView } from '@kici-dev/engine/protocol/dashboard-write-operations';
//# sourceMappingURL=dashboard-write-policy.d.ts.map