/**
 * Admin API routes for execution run inspection.
 *
 * Provides read-only endpoints for listing runs and inspecting per-run
 * sub-resources (jobs, ephemeral key status, secret outputs). All routes
 * are protected by Bearer token authentication and an RBAC permission
 * check (`run.read` for most, `secret.reveal` for the reveal variant of
 * `secret-outputs`).
 *
 * Endpoints:
 *   GET /api/v1/admin/runs                        — list runs with filters
 *   GET /api/v1/admin/runs/:runId                 — run header fields only
 *   GET /api/v1/admin/runs/:runId/jobs            — jobs list (optional steps)
 *   GET /api/v1/admin/runs/:runId/ephemeral-key   — scrub status
 *   GET /api/v1/admin/runs/:runId/secret-outputs  — masked by default; ?reveal=true
 *
 * This is the server-side counterpart to `kici-admin runs` — the dogfooded
 * replacement for hand-rolled curl commands and dashboard clicks when
 * verifying execution state.
 */
import { Hono } from 'hono';
import type { Kysely } from 'kysely';
import type { Database } from '../db/types.js';
import type { TokenManager } from '../secrets/token-manager.js';
import type { RbacEnforcer, Role } from '../secrets/rbac.js';
import type { AuditLogger } from '../secrets/audit-logger.js';
/**
 * Dependencies for admin run routes.
 */
export interface AdminRunRoutesDeps {
    db: Kysely<Database>;
    tokenManager: TokenManager;
    rbac: RbacEnforcer;
    /** Required to reveal secret-output plaintext via ?reveal=true. */
    auditLogger?: AuditLogger;
    /**
     * Orchestrator master secret key (raw hex / base64). Required to reveal
     * secret-output plaintext. Derived once per request via deriveKey().
     */
    masterSecretKey?: string;
}
/** Hono env type for admin run routes with context variables. */
type AdminRunEnv = {
    Variables: {
        role: Role;
        userId: string;
        routingKey: string | null;
    };
};
/**
 * Create admin API routes for execution run inspection.
 *
 * @param deps - Admin run route dependencies
 * @returns Hono app with run routes mounted at /api/v1/admin/runs
 */
export declare function createAdminRunRoutes(deps: AdminRunRoutesDeps): Hono<AdminRunEnv>;
export {};
//# sourceMappingURL=admin-runs.d.ts.map