import type { Pool } from "pg";
import { type AdminIo, type AdminKeySource } from "./admin-input.js";
export declare function initializeIntake(pool: Pool, sinkId: string, authorityId: string): Promise<void>;
export declare function bindProducer(pool: Pool, input: {
    producer_id: string;
    tenant_id: string;
    app: string;
    corpus_id: string;
    source_authority_id: string;
}): Promise<void>;
export declare function grantProducerKey(pool: Pool, tenant: string, producer: string, kid: string): Promise<void>;
export declare function revokeProducerAccess(pool: Pool, tenant: string, producer: string, kid?: string): Promise<void>;
/** Payload grants are provisioned explicitly by the owner, never by API callers. */
export declare function grantConsumerKey(pool: Pool, input: {
    tenant_id: string;
    consumer_id: string;
    producer_id: string;
    kid: string;
    types: string[];
    subject?: string;
}): Promise<void>;
export declare function revokeConsumerKey(pool: Pool, tenant: string, consumer: string, producer: string, kid: string): Promise<void>;
/** Metadata about a registered key. Never the key, never its full hash. */
export interface RegisteredKeyMetadata {
    kid: string;
    tenant_id: string;
    scopes: string[];
    expires_at: string | null;
    key_length: number;
    key_sha256_prefix: string;
}
/** Result of one admin operation: identifiers and metadata only, safe to print. */
export type IntakeAdminResult = {
    operation: string;
} | ({
    operation: "register-key";
    key_source: AdminKeySource;
} & RegisteredKeyMetadata);
/** Register an already-issued signed key; never mint or print it. A repeat is refused, never a silent success. */
export declare function registerIntakeKey(pool: Pool, token: string, signingSecret: string): Promise<RegisteredKeyMetadata>;
/**
 * Owner-only admin operations. Secrets come only from the environment
 * (`io.env`, default `process.env`); argv carries non-secret selectors and is
 * refused when it carries a secret. `register-key` reads the issued key from
 * HASNA_EVENTS_ADMIN_API_KEY or HASNA_EVENTS_ADMIN_API_KEY_FILE; with neither
 * set it reads piped stdin (never a terminal), and `--key-source stdin` is an
 * explicit alias for that.
 */
export declare function runIntakeAdmin(pool: Pool, args: string[], signingSecret?: string, io?: AdminIo): Promise<IntakeAdminResult>;