import type { Kysely } from 'kysely';
import { type ActorPrincipal } from '@kici-dev/engine';
import type { Database } from '../db/types.js';
import type { RegistrationStore } from '../registration/registration-store.js';
import type { RegistrationIndex } from '../registration/registration-index.js';
import type { AccessLogWriter } from '../audit/access-log.js';
interface DashboardRegistrationsHandlerDeps {
    /** Organization ID for all operations. */
    orgId: string;
    /** Send a response message back to Platform over the WS connection. */
    send: (msg: unknown) => void;
    /** Registration store for DB queries. */
    registrationStore: RegistrationStore;
    /** Registration index for version info. */
    registrationIndex: RegistrationIndex;
    /** Database for execution_runs and cron_last_fired queries. */
    db: Kysely<Database>;
    /** Access log writer — records one row per read / mutation with actor attribution. */
    accessLog?: AccessLogWriter;
    /** Routing key for access_log rows (null when not run-scoped). */
    routingKey?: string | null;
}
interface RegistrationsListMessage {
    type: 'dashboard.registrations.list';
    requestId: string;
    actor: ActorPrincipal;
    triggerType?: string;
    repoIdentifier?: string;
}
interface RegistrationDisableMessage {
    type: 'dashboard.registration.disable';
    requestId: string;
    actor: ActorPrincipal;
    registrationId: string;
    disabled: boolean;
}
interface RegistrationDeleteMessage {
    type: 'dashboard.registration.delete';
    requestId: string;
    actor: ActorPrincipal;
    registrationId: string;
    cancelActiveRuns?: boolean;
}
type RegistrationMessage = RegistrationsListMessage | RegistrationDisableMessage | RegistrationDeleteMessage;
/**
 * Handler for dashboard registration WS messages (list, disable, delete).
 *
 * Queries registration store, enriches with last-triggered and next-fire data,
 * and sends typed response via deps.send().
 */
export declare class DashboardRegistrationsHandler {
    private readonly deps;
    private routingKey;
    private readonly accessLog;
    constructor(deps: DashboardRegistrationsHandlerDeps);
    /** Update the orgId used for all operations (called when resolved from DB). */
    setOrgId(orgId: string): void;
    /** Update the routing key bound to access_log rows. */
    setRoutingKey(routingKey: string | null): void;
    /**
     * Defense-in-depth dashboard-write policy gate. Returns true when the
     * operation is allowed and the caller should proceed. Returns false
     * when the policy is disabled — also records a `denied` access_log row
     * and emits a structured `operation_disabled` envelope on the WS.
     */
    private enforcePolicy;
    /**
     * Write an access_log row for a handler invocation. Uses the handler's
     * bound orgId + routingKey, the msg.actor principal, and the handler-
     * specified action + target. Best-effort; the writer swallows failures.
     */
    private recordAccess;
    handle(msg: RegistrationMessage): Promise<void>;
    private handleDisable;
    private handleDelete;
    /**
     * Batch-fetch source metadata for the routing keys in the registrations,
     * keyed on `routing_key`. The map combines rows from `sources` (native,
     * currently always GitHub Apps) and `generic_webhook_sources` (generic /
     * universal-git / internal). When a routing key is present in both, the
     * native row wins.
     *
     * Each query is wrapped in its own try/catch so a transient failure on
     * one table still allows enrichment from the other; rows missing in both
     * fall through to the synthetic fallback in `buildRegistrationSource`.
     */
    private loadSourceMetadata;
    private handleList;
}
export {};
//# sourceMappingURL=dashboard-registrations-handler.d.ts.map