/**
 * Local admin proxy for the agent.neotoma.io feedback pipeline.
 *
 * The canonical admin API (`POST /feedback/:id/status`,
 * `GET /feedback/pending`, `GET /feedback/by_commit/:sha`) lives on
 * `agent.neotoma.io` and is gated by the `AGENT_SITE_ADMIN_BEARER` shared
 * secret. The Inspector cannot hold that secret — it would leak on any
 * dev workstation — so we expose a thin proxy from the local Neotoma
 * server that:
 *
 *   1. Gates requests to hardware/software/operator_attested AAuth tiers
 *      or a short-lived local admin session minted from those tiers, so a
 *      random local browser tab without trusted identity cannot drive
 *      pipeline writes.
 *   2. In `hosted` mode, forwards the body untouched to agent.neotoma.io,
 *      injecting the admin bearer from server-side env.
 *   3. In `local` mode, reads/writes the on-disk `LocalFeedbackStore`
 *      and mirrors every write into the `neotoma_feedback` entity graph
 *      via `mirrorLocalFeedbackToEntity`.
 *   4. Returns 501 `admin_proxy_unconfigured` only when
 *      `NEOTOMA_FEEDBACK_ADMIN_MODE=disabled`.
 *
 * Mode is resolved per request from `NEOTOMA_FEEDBACK_ADMIN_MODE` (explicit)
 * or the `AGENT_SITE_BASE_URL` + `AGENT_SITE_ADMIN_BEARER` pair (inferred).
 */
import type { Express, Request, Response } from "express";
import { getRedeemedFeedbackAdminSession, type FeedbackAdminSessionSnapshot } from "./admin_session.js";
export type AdminFeedbackMode = "hosted" | "local" | "disabled";
interface AdminProxyEnv {
    baseUrl: string;
    bearer: string;
}
declare function readAdminProxyEnv(): AdminProxyEnv | null;
export declare function resolveAdminFeedbackMode(env?: Record<string, string | undefined>): AdminFeedbackMode;
/** Public shape for preflight callers; used by the Inspector to flip the UI. */
export interface AdminProxyPreflight {
    configured: boolean;
    mode: AdminFeedbackMode;
    base_url_env: string;
    bearer_env: string;
    mode_env: string;
    allowed_tiers: string[];
    current_direct_tier: string;
    admin_session: FeedbackAdminSessionSnapshot;
}
declare function preflightPayload(configured: boolean, mode: AdminFeedbackMode, req?: Request): AdminProxyPreflight;
/**
 * Resolve admin identity from either direct verified AAuth on the request
 * or a short-lived local admin session minted by the unlock bridge.
 */
declare function resolveFeedbackAdminIdentity(req: Request): {
    source: "aauth";
    tier: string;
    thumbprint?: string;
    sub?: string;
    iss?: string;
} | {
    source: "admin_session";
    tier: string;
    thumbprint?: string;
    sub?: string;
    iss?: string;
    expires_at: string;
} | null;
declare function enforceFeedbackAdminIdentity(req: Request, res: Response): boolean;
declare function sendUnconfigured(res: Response): void;
declare function listAllLocal(_req: Request, res: Response): Promise<void>;
declare function listPendingLocal(req: Request, res: Response): Promise<void>;
declare function findByCommitLocal(req: Request, res: Response, sha: string): Promise<void>;
declare function updateStatusLocal(req: Request, res: Response, id: string): Promise<void>;
/**
 * Mount admin proxy routes onto the Neotoma HTTP server. Safe to call
 * once at server boot. Returns silently when no registration is needed
 * so callers do not have to guard on env vars themselves.
 */
export declare function registerFeedbackAdminProxyRoutes(app: Express): void;
/** Exposed for tests. */
export declare const FEEDBACK_ADMIN_PROXY_INTERNALS: {
    readAdminProxyEnv: typeof readAdminProxyEnv;
    preflightPayload: typeof preflightPayload;
    resolveFeedbackAdminIdentity: typeof resolveFeedbackAdminIdentity;
    enforceFeedbackAdminIdentity: typeof enforceFeedbackAdminIdentity;
    sendUnconfigured: typeof sendUnconfigured;
    resolveAdminFeedbackMode: typeof resolveAdminFeedbackMode;
    listAllLocal: typeof listAllLocal;
    listPendingLocal: typeof listPendingLocal;
    findByCommitLocal: typeof findByCommitLocal;
    updateStatusLocal: typeof updateStatusLocal;
    getRedeemedFeedbackAdminSession: typeof getRedeemedFeedbackAdminSession;
};
export {};
//# sourceMappingURL=admin_proxy.d.ts.map