/**
 * Per-workflow dispatch pipeline.
 *
 * Handles everything that happens AFTER a workflow has been matched against an
 * incoming webhook: payload storage, cache + build coordination, secret
 * resolution, per-job environment evaluation, static job dispatch (cluster +
 * single-orch paths), execution-tracker registration, deferred init dispatch
 * for jobs with dynamic fields, and deferred dynamic-job-fn dispatch for
 * `_type:'dynamic'` lock entries.
 *
 * Splits the historic 2438-line `dispatchMatchedWorkflow` into typed phase
 * helpers so each piece can be reasoned about independently. The main
 * exported function is a narrative orchestrator that threads the typed
 * results through the pipeline.
 */
import { CacheRefScope } from '@kici-dev/engine';
import type { LockWorkflow, SimulatedEvent, WorkflowDecision } from '@kici-dev/engine';
import type { WebhookInfo } from '../webhook/handler.js';
import type { ProviderBundle } from '../provider-registry.js';
import type { TrustResolution } from '../security/trust-resolver.js';
import { type ProcessingDeps } from './processor.js';
/**
 * Trusted refs (write+ contributor, default-branch) get the org-shared cache
 * write scope; everyone else (fork PR, unknown/known-but-not-trusted) is
 * confined to a per-run isolated write scope. Absent trust resolution =>
 * isolated (fail-closed), so an unresolved trust state can never poison the
 * org-shared cache.
 */
export declare function deriveCacheRefScope(trust: TrustResolution | undefined): CacheRefScope;
/**
 * Context for dispatching a single matched workflow.
 *
 * Captures every per-workflow closure dependency so the dispatch body is
 * callable from BOTH the same-source path AND the cross-source delegation
 * shell. `crossSource` is the discriminator the helper uses to override the
 * dispatch `deliveryId` so fan-out targets land on their composite dedup
 * slot (`${inbound.deliveryId}:${reg.id}`) instead of the inbound delivery
 * id.
 */
export interface WorkflowDispatchContext {
    info: WebhookInfo;
    deps: ProcessingDeps;
    bundle: ProviderBundle;
    payload: unknown;
    repoIdentifier: string;
    credentials: Record<string, unknown>;
    event: SimulatedEvent;
    eventWithFiles: SimulatedEvent;
    ref: string;
    fullLockFile: {
        workflows: readonly LockWorkflow[];
        lockfileHash?: string;
        source: {
            file: string;
        };
    };
    resolvedOrgId: string;
    workflow: LockWorkflow;
    decision: WorkflowDecision;
    runId: string;
    trustResolution: TrustResolution | undefined;
    lockFileSource: string | undefined;
    /** True only when invoked from the cross-source dispatch shell. */
    crossSource: boolean;
    /** Composite dedup key `${info.deliveryId}:${reg.id}` (cross-source only). */
    crossSourceDeliveryId?: string;
    /**
     * Routing key to use for dispatched QueuedJobInput + log / tracker rows.
     * Same-source: equal to `info.routingKey`. Cross-source: equal to
     * `reg.routingKey` (the registration's owning source, NOT the inbound
     * generic routing key).
     */
    effectiveRoutingKey?: string;
    /**
     * Provider identifier to use for dispatched QueuedJobInput + tracker rows.
     * Same-source: equal to `info.provider`. Cross-source: equal to
     * `regBundle.normalizer.provider` (the registration's provider type,
     * e.g. 'github').
     */
    effectiveProvider?: string;
    /**
     * Extra jobConfig fields merged into every dispatched QueuedJobInput by
     * this helper. Cross-source callers use this to inject provenance fields
     * (`crossSource: true`, `inboundRoutingKey`, `inboundEventName`,
     * `workflowRepoUrl`, `workflowRef`, `workflowSha`,
     * `workflowRepoIdentifier`) that downstream agents / dashboards need for
     * correct clone + logging.
     */
    extraJobConfig?: Record<string, unknown>;
}
export interface DispatchMatchedWorkflowResult {
    /** Number of jobs successfully dispatched (non-rejected). */
    dispatchedJobCount: number;
}
/**
 * Dispatch a single matched workflow.
 *
 * Narrative orchestrator: each phase is a typed helper that returns a typed
 * result the next phase consumes. The function reads top-to-bottom as the
 * pipeline:
 *   A. setup → wrapped dispatcher + overlaid info
 *   B. cache + build → buildPrep with cache URLs and build-job state
 *   C. workflow secrets + ephemeral key → secret bundle
 *   D. per-job env evaluation → job env data + deferred-init queue
 *   E+F+G. static job dispatch → dispatchedJobs / rejectedJobs
 *   H. execution-tracker registration + edges + rejected-mark
 *   I. deferred init dispatch (fire-and-forget per job)
 *   J. deferred dynamic dispatch (fire-and-forget per dynamic entry)
 */
export declare function dispatchMatchedWorkflow(ctx: WorkflowDispatchContext): Promise<DispatchMatchedWorkflowResult>;
//# sourceMappingURL=dispatch-matched-workflow.d.ts.map