import type { IncomingMessage, ServerResponse } from 'node:http';
import type { OwlCodaConfig } from './config.js';
import type { PlatformCatalog } from './models/catalog.js';
import { ProviderProbe } from './provider-probe.js';
import { type DiscoveredRuntime } from './localhost-discovery.js';
import { EndpointHealthCache } from './endpoint-health-cache.js';
import { ModelConfigMutator, type CreateEndpointModelPatch, type UpdateModelFieldsPatch, type BindDiscoveredModelPatch } from './model-config-mutator.js';
import type { ModelTruthSnapshot } from './model-truth.js';
export declare const ADMIN_API_SCHEMA_VERSION = 1;
export interface AdminApiDeps {
    getConfig: () => OwlCodaConfig;
    getSnapshot: (options?: {
        skipCache?: boolean;
    }) => Promise<ModelTruthSnapshot>;
    getCatalog: () => PlatformCatalog | null;
    mutator: ModelConfigMutator;
    providerProbe: ProviderProbe;
    discoverLocalRuntimes?: () => Promise<DiscoveredRuntime[]>;
    endpointHealthCache?: EndpointHealthCache;
    auth: AdminAuthManager;
}
export interface AdminApiResultItem {
    id: string;
    ok: boolean;
    error?: {
        code: string;
        message: string;
    };
    data?: unknown;
}
export interface BulkPatchItem {
    id: string;
    patch: UpdateModelFieldsPatch;
}
export interface BulkBindItem {
    discoveredId: string;
    patch?: BindDiscoveredModelPatch;
}
export interface BulkCreateItem {
    model: CreateEndpointModelPatch;
}
export declare class AdminAuthManager {
    private readonly bearerToken;
    private readonly sessionTtlMs;
    private readonly oneShotTtlMs;
    private readonly sessions;
    private readonly oneShotTokens;
    constructor(bearerToken: string, options?: {
        sessionTtlMs?: number;
        oneShotTtlMs?: number;
    });
    issueOneShotToken(): string;
    exchangeOneShotToken(token: string): {
        sessionId: string;
        csrfToken: string;
    } | null;
    buildSessionCookie(sessionId: string): string;
    authenticate(req: IncomingMessage, options?: {
        requireCsrf?: boolean;
    }): {
        ok: boolean;
        status?: number;
        code?: string;
        message?: string;
    };
    private pruneExpired;
}
export declare function handleAdminApiRequest(req: IncomingMessage, res: ServerResponse, deps: AdminApiDeps): Promise<boolean>;
export declare function createAdminAuthManager(config: OwlCodaConfig): AdminAuthManager;
