/**
 * Secret inputs for the owner-only `events-serve admin` operations.
 *
 * The production route takes every secret from the process environment, which
 * is how a one-shot container task receives injected secrets: the owner
 * connection (`HASNA_EVENTS_DATABASE_URL`), the signing key
 * (`HASNA_EVENTS_API_SIGNING_KEY`) and, for `register-key`, the already-issued
 * Events API key. It never reads stdin and never needs a terminal. With neither
 * key input set, `register-key` keeps its original piped-stdin behaviour.
 */
export declare const ADMIN_API_KEY_ENV = "HASNA_EVENTS_ADMIN_API_KEY";
/** Absolute path of an owner-only regular file holding the issued key (alternative to the value). */
export declare const ADMIN_API_KEY_FILE_ENV = "HASNA_EVENTS_ADMIN_API_KEY_FILE";
/** Environment values that are secret and therefore must never also appear in argv. */
export declare const ADMIN_SECRET_ENV: readonly ["HASNA_EVENTS_DATABASE_URL", "HASNA_EVENTS_API_SIGNING_KEY", "HASNA_EVENTS_ADMIN_API_KEY"];
export declare const MAX_ADMIN_API_KEY_BYTES = 16384;
export type AdminKeySource = "env" | "file" | "stdin";
export type AdminEnv = Readonly<Record<string, string | undefined>>;
export interface AdminStdin extends AsyncIterable<string | Uint8Array> {
    readonly isTTY?: boolean;
}
export interface AdminIo {
    /** Defaults to `process.env`. */
    env?: AdminEnv;
    /** Read only when neither key input is set. Defaults to `process.stdin`. */
    stdin?: AdminStdin;
}
/**
 * Refuse any argv entry that is, names or contains a secret. Admin selectors
 * (ids, types, subject) are not secret; secrets travel only through the
 * environment. Runs before any database contact and never echoes the value.
 */
export declare function refuseSecretArguments(args: readonly string[], env: AdminEnv): void;
/**
 * Resolve the issued key for `register-key`.
 *
 * - an injected input (production): exactly one of `HASNA_EVENTS_ADMIN_API_KEY`
 *   or `HASNA_EVENTS_ADMIN_API_KEY_FILE`; both is refused, and stdin is never
 *   touched;
 * - neither set (the original local behaviour): the key is read from piped
 *   stdin, which must not be a terminal. Closed or empty stdin, as in a one-shot
 *   task with no input, fails closed at EOF with `admin_api_key_input_required`;
 * - `--key-source stdin` (`selection === "stdin"`) is an explicit alias for the
 *   stdin route and is refused when either variable is also set.
 *
 * A set-but-empty variable counts as given, so it fails closed rather than
 * silently selecting another input.
 */
export declare function readAdminApiKey(selection: "auto" | "stdin", io: AdminIo): Promise<{
    token: string;
    source: AdminKeySource;
}>;