import type { Migration, MigrationContext, MigrationResult } from "./migration.interface.js";
/**
 * Migration: grant the reusable quality workflow's caller the token scopes the
 * work-item traceability backstop needs, and map the tracker credentials it
 * needs to verify a PR backlink.
 *
 * Downstream `.github/workflows/ci.yml` is create-only, so a repo installed
 * before #2046 can never receive these through the copy strategies — its
 * backstop runs but reports not-enforceable forever. This migration closes that
 * gap in place.
 *
 * A caller with NO `permissions:` block is the BROKEN shape, not the safe one.
 * It was previously skipped on the premise that the repo default is "typically
 * permissive"; measurement disproved that (#2476). On two private consumers a
 * block-less caller job received `contents: read` + `metadata: read`, so
 * `gh pr view` and `gh issue view` both failed and the gate could never pass —
 * while a sibling repo whose caller granted the two read scopes ran the real
 * validation. Those repos can never self-heal through the copy strategies
 * either, because `.github/workflows/ci.yml` is create-only. So this migration
 * now writes the block when it is absent.
 *
 * Still deliberately conservative, because it edits a file the host owns:
 *
 * - Grants read-only scopes for `quality.yml`, whose 32 jobs were audited to
 *   need no write scope (#1769), so an invented block cannot cost a job access
 *   it uses today. `quality-rails.yml` declares `checks: write` and
 *   `pull-requests: write` at the workflow level, and a caller granting less
 *   than the called workflow declares is a startup_failure for the whole run
 *   (#2049) — so a rails caller is granted those levels, never `read`.
 * - Never downgrades: a scope already granted at `write` is left alone.
 * - Never rewrites `secrets: inherit` into an explicit map — that is the host's
 *   choice and converting it changes what the called workflow receives.
 * - Adds only the credentials the configured tracker actually uses; a
 *   github-tracker repo needs none, so it gets no secret noise.
 */
export declare class EnsureQualityCallerScopesMigration implements Migration {
    readonly name = "ensure-quality-caller-scopes";
    readonly description = "Grant the CI quality caller issues/pull-requests read and map tracker credentials for the work-item backstop";
    /**
     * Compute what this migration would change, without writing.
     * @param ctx - Migration context
     * @returns The planned edit
     */
    private plan;
    /**
     * Applies when the caller is missing a needed scope or tracker credential.
     * @param ctx - Migration context
     * @returns True when there is work to do
     */
    applies(ctx: MigrationContext): Promise<boolean>;
    /**
     * Insert the missing permission scopes and tracker secret mappings.
     * @param ctx - Migration context
     * @returns Result describing the action taken
     */
    apply(ctx: MigrationContext): Promise<MigrationResult>;
}
//# sourceMappingURL=ensure-quality-caller-scopes.d.ts.map