import type { BackendSyncManager, DashboardPlatformToOrchMessage } from '@kici-dev/engine';
import type { BackendRegistry } from '../secrets/backend-registry.js';
import type { BackendHealthChecker } from '../secrets/backend-health.js';
import type { AccessLogWriter } from '../audit/access-log.js';
import type { Kysely } from 'kysely';
import type { Database } from '../db/types.js';
interface DashboardBackendsHandlerDeps {
    /** Send a response message back to Platform over the WS connection. */
    send: (msg: unknown) => void;
    registry: BackendRegistry;
    healthChecker: BackendHealthChecker;
    syncManager?: BackendSyncManager;
    /** Database — required for dashboard-write policy lookups. */
    db: Kysely<Database>;
    /** Access log writer — records one row per read / mutation with actor attribution. */
    accessLog?: AccessLogWriter;
    /** Org ID for access_log rows (null when the orchestrator isn't org-scoped). */
    orgId?: string | null;
    /** Routing key for access_log rows (null when not run-scoped). */
    routingKey?: string | null;
}
/**
 * Handler for all dashboard backend WS messages.
 *
 * Dispatches incoming messages by type and calls the appropriate backend services.
 */
export declare class DashboardBackendsHandler {
    private readonly deps;
    private orgId;
    private routingKey;
    private readonly accessLog;
    constructor(deps: DashboardBackendsHandlerDeps);
    /**
     * Update the bound orgId + routingKey. Called from server.ts after resolving
     * the single tenant org from the `sources` / `generic_webhook_sources` table.
     */
    setOrgContext(orgId: string | null, routingKey: string | null): void;
    /**
     * Defense-in-depth dashboard-write policy gate. Returns true when the
     * operation is allowed and the caller should proceed. Returns false
     * when the policy is disabled — also records a `denied` access_log row
     * and emits a structured `operation_disabled` envelope on the WS.
     *
     * Fails open when no org is bound — the orch hasn't resolved a
     * customer yet, so there's nothing to look up.
     */
    private enforcePolicy;
    /**
     * Write an access_log row for a handler invocation. Best-effort; the writer
     * swallows failures.
     */
    private recordAccess;
    /**
     * Route a dashboard backends message to the appropriate handler.
     * Returns true if the message was handled, false otherwise.
     */
    handleMessage(msg: DashboardPlatformToOrchMessage): Promise<boolean>;
    private handleList;
    private handleGet;
    private handleSyncAll;
    private handleSyncOne;
    private handleTest;
}
export {};
//# sourceMappingURL=dashboard-backends-handler.d.ts.map