/**
 * WebSocket handler for observer connections.
 *
 * CLI clients connect to observe a running execution in real-time.
 * The observer channel is read-only: clients subscribe with a run ID
 * and token, then receive log chunks, step status changes, and
 * completion events broadcast by the ObserverRegistry.
 *
 * Auth flow:
 * 1. Connection opens, 5-second auth timeout starts
 * 2. First message must be `observe.subscribe` with valid token and runId
 * 3. Token validated against admin_tokens (same as admin API auth)
 * 4. Run ID validated against execution_runs table
 * 5. If valid: registered in ObserverRegistry, initial status sent
 * 6. Subsequent messages ignored (read-only channel)
 * 7. On close: unregistered from ObserverRegistry
 */
import type { WSEvents } from 'hono/ws';
import type { Kysely } from 'kysely';
import type { Database } from '../db/types.js';
import type { ObserverRegistry } from './observer-registry.js';
import type { TokenManager } from '../secrets/token-manager.js';
export declare const WS_CLOSE_OBSERVER_AUTH_FAILED = 4001;
export declare const WS_CLOSE_OBSERVER_AUTH_TIMEOUT = 4002;
export declare const WS_CLOSE_OBSERVER_INVALID_MESSAGE = 4003;
export declare const WS_CLOSE_OBSERVER_RUN_NOT_FOUND = 4030;
export interface ObserverHandlerDeps {
    observerRegistry: ObserverRegistry;
    db: Kysely<Database>;
    tokenManager: TokenManager;
}
/**
 * Create a Hono WS event handler for observer connections.
 *
 * Flow:
 * 1. onOpen: start 5-second auth timeout
 * 2. First onMessage: must be observe.subscribe with valid token + runId
 * 3. Subsequent messages: ignored (read-only channel)
 * 4. onClose: cleanup from registry
 */
export declare function createObserverWsHandler(deps: ObserverHandlerDeps): WSEvents;
//# sourceMappingURL=observer-handler.d.ts.map