/**
 * WebSocket handler for incoming peer connections from other orchestrators.
 *
 * Accepts WS upgrade, performs ECDH key exchange for encrypted channel,
 * validates authentication via join token (first connect) or HMAC credential
 * proof (reconnection), registers the peer in PeerRegistry, and routes
 * messages bidirectionally. Sends periodic heartbeats to the connecting peer.
 */
import { type PeerHeartbeat, type PeerToPeerMessage, type JobReroute, type JobProgress, type PeerScalerEvent, type PeerJobCancel, type PeerLogChunk, type PeerCacheUploadRequest, type PeerCacheUploadResponse, type PeerConfigReload, type PeerConfigReloadResponse, type PeerLeaving, type PeerAgentTokenRevoke, type RaftVoteRequest, type RaftVoteResponse, type RaftAppendEntries } from '@kici-dev/engine';
import type { PeerRegistry } from './peer-registry.js';
import type { PeerCredentialStore } from './peer-credentials.js';
import { type JoinTokenManager } from './join-token.js';
/**
 * Minimal WebSocket interface for peer connections.
 * Same pattern as agent/registry.ts WsLike, allowing mock testing.
 */
export interface PeerWsLike {
    send(data: string): void;
    close(code?: number, reason?: string): void;
    on(event: string, listener: (...args: unknown[]) => void): void;
    readyState: number;
}
export interface PeerHandlerDeps {
    /** Join token manager for validating first-time peer tokens. */
    tokenManager: JoinTokenManager;
    /** Credential store for session credential CRUD. */
    credentialStore: PeerCredentialStore;
    /** Accepted roles for connecting peers. Default: ['coordinator', 'worker'] (accept any). */
    acceptedRoles?: Array<'coordinator' | 'worker'>;
    /** This orchestrator's instance ID. */
    instanceId: string;
    /** Peer registry to track incoming peers. */
    peerRegistry: PeerRegistry;
    /** Callback to get this orchestrator's local agent inventory for heartbeats. */
    getLocalInventory: () => Omit<PeerHeartbeat, 'type'>;
    /** Heartbeat interval in ms. Default: 30000 (30s). */
    heartbeatIntervalMs?: number;
    /** Auth timeout in ms. Default: 15000 (15s). */
    authTimeoutMs?: number;
    /** Callback when a job reroute request is received from peer. */
    onJobReroute: (msg: JobReroute) => Promise<void>;
    /** Callback when a job progress update is received from peer. */
    onJobProgress: (msg: JobProgress) => void;
    /** Callback when a scaler provisioning event is forwarded by a worker peer. */
    onPeerScalerEvent?: (msg: PeerScalerEvent) => void;
    /** Callback when a job cancel request is received from peer. */
    onJobCancel: (msg: PeerJobCancel) => void;
    /** Callback when a log chunk is received from a worker peer. */
    onPeerLogChunk?: (chunk: PeerLogChunk, peerId: string) => void;
    /** Callback when a cache upload request is received from a worker peer. */
    onPeerCacheUploadRequest?: (req: PeerCacheUploadRequest, peerId: string) => Promise<PeerCacheUploadResponse>;
    /** Callback for Raft vote requests. */
    onRaftVoteRequest?: (msg: RaftVoteRequest) => RaftVoteResponse;
    /** Callback for Raft vote responses (forwarded to Raft module). */
    onRaftVoteResponse?: (msg: RaftVoteResponse) => void;
    /** Callback for Raft append entries (leader heartbeat). */
    onRaftAppendEntries?: (msg: RaftAppendEntries) => void;
    /** Callback when a peer.leaving announcement is received. */
    onPeerLeaving?: (msg: PeerLeaving) => void;
    /**
     * Callback when a peer.agent-token.revoke announcement is received.
     * The local handler should call agentRegistry.disconnectByTokenId(tokenId)
     * to close every in-flight WS authenticated by the now-revoked token.
     */
    onAgentTokenRevoke?: (msg: PeerAgentTokenRevoke) => void;
    /**
     * Callback when a config reload request is received from a peer.
     * Should execute a local config reload and return the result fields,
     * which are sent back via peer.config.reload.response.
     *
     * If undefined, incoming reload requests are answered with success=false
     * and an error explaining that reload is unavailable on this peer.
     */
    onPeerConfigReload?: (msg: PeerConfigReload) => Promise<{
        success: boolean;
        version?: number;
        errors?: string[];
        restartRequired?: string[];
        fieldsChanged?: string[];
    }>;
}
/**
 * Create a handler function for incoming peer WebSocket connections.
 *
 * Returns `handleConnection(ws, remoteIp?)` which should be called when a new
 * WebSocket connection is upgraded on the peer endpoint.
 */
export declare function createPeerHandler(deps: PeerHandlerDeps): {
    handleConnection: (ws: PeerWsLike, remoteIp?: string) => void;
    sendToPeer: (targetInstanceId: string, msg: PeerToPeerMessage) => boolean;
    sendAndWaitAck: (targetInstanceId: string, msg: JobReroute, timeoutMs?: number) => Promise<boolean>;
    sendConfigReloadAndWait: (targetInstanceId: string, msg: PeerConfigReload, timeoutMs?: number) => Promise<PeerConfigReloadResponse | null>;
    getConnectionCount: () => number;
    broadcastHeartbeat: (inventory: Omit<PeerHeartbeat, "type">) => void;
    broadcastAgentTokenRevoke: (msg: PeerAgentTokenRevoke) => void;
    cleanup: () => void;
    closeAllInbound: () => void;
};
//# sourceMappingURL=peer-handler.d.ts.map