/**
 * Dashboard global-workflows handler for the orchestrator.
 *
 * Responds to `dashboard.global-workflows.*` WS messages from Platform by
 * reading or upserting the `org_settings` row keyed by `customer_id`. The
 * row holds the org-level global-workflow policy: master enable, plus the
 * three repo-pattern lists (allow / deny / elevate). Each list entry is a
 * `{routingKey?, pattern}` object that may optionally pin to one source.
 *
 * The handler binds a single `customerId` at construction time (via the
 * sources / generic_webhook_sources lookup at server startup) and updates
 * via setOrgId() when a real customer source registers.
 */
import { type Kysely } from 'kysely';
import type { GlobalWorkflowsGetRequest, GlobalWorkflowsUpdateRequest, GlobalWorkflowSettings, RepoPatternEntry } from '@kici-dev/engine/protocol/dashboard-global-workflows';
import type { Database, OrgSettings } from '../db/types.js';
import type { AccessLogWriter } from '../audit/access-log.js';
interface DashboardGlobalWorkflowsHandlerDeps {
    /** Customer / org identifier — primary key on org_settings. */
    customerId: string;
    /** Send a response message back to Platform over the WS connection. */
    send: (msg: unknown) => void;
    db: Kysely<Database>;
    /** Access log writer — records one row per read / mutation with actor attribution. */
    accessLog?: AccessLogWriter;
}
type GlobalWorkflowsMessage = GlobalWorkflowsGetRequest | GlobalWorkflowsUpdateRequest;
/**
 * Returns true when the message is one this handler can dispatch. Used by the
 * server to route incoming WS messages.
 */
export declare function isDashboardGlobalWorkflowsMessage(msg: {
    type: string;
} | null | undefined): msg is GlobalWorkflowsMessage;
export declare class DashboardGlobalWorkflowsHandler {
    private readonly deps;
    private readonly accessLog;
    constructor(deps: DashboardGlobalWorkflowsHandlerDeps);
    /** Update the customer / org id this handler operates on. */
    setOrgId(customerId: string | null): void;
    /**
     * Defense-in-depth dashboard-write policy gate. Returns true when the
     * operation is allowed; false (with a structured `operation_disabled`
     * envelope and a `denied` access_log row) when policy says no.
     */
    private enforcePolicy;
    /**
     * Write an access_log row for a handler invocation. Best-effort; the writer
     * swallows failures.
     */
    private recordAccess;
    handleMessage(msg: GlobalWorkflowsMessage): Promise<boolean>;
    private handleGet;
    private handleUpdate;
    private readRow;
    private upsertRow;
    private sendError;
}
interface NormalizedPatch {
    enabled: boolean;
    allowedRepos: RepoPatternEntry[] | null;
    deniedRepos: RepoPatternEntry[] | null;
    elevatedRepos: RepoPatternEntry[] | null;
}
/**
 * Derive the effective storage state from an existing row (may be undefined)
 * plus a partial update message. Unset fields fall back to the existing value;
 * an explicit `null` clears the corresponding column.
 */
export declare function buildPatch(existing: OrgSettings | undefined, msg: GlobalWorkflowsUpdateRequest): NormalizedPatch;
/**
 * Project a row into the public settings shape. Returns a defaulted "disabled"
 * settings object when the row does not yet exist, so callers always get a
 * renderable state.
 */
export declare function rowToSettings(customerId: string, row: OrgSettings | undefined): GlobalWorkflowSettings;
export {};
//# sourceMappingURL=dashboard-global-workflows-handler.d.ts.map