/**
 * Zod schema + preset table for universal-git source configuration.
 *
 * A universal-git source is a `generic_webhook_sources` row with a non-null
 * `git_config` column. The config carries everything the orchestrator needs
 * to build clone URLs, fetch lock files, parse changed files, and issue
 * clone credentials against a user-supplied git server (Forgejo / Gitea /
 * Gogs / GitLab repo-webhook / plain GitHub repo-webhook).
 *
 * Presets expand into full `payloadPaths` for each supported forge; custom
 * (preset-less) configs spell out the paths explicitly. Adding a new forge
 * means adding a row to `UNIVERSAL_GIT_PRESETS` — no new migration, no
 * provider code changes.
 */
import { z } from 'zod';
/**
 * Preset identifier. Picks a canonical payload-path bundle for a forge whose
 * webhook shape is close enough to GitHub's that JSONPath extraction works
 * verbatim.
 */
export declare const UniversalGitPreset: z.ZodEnum<{
    custom: "custom";
    forgejo: "forgejo";
    gitea: "gitea";
    gogs: "gogs";
    "gitlab-repo": "gitlab-repo";
    "github-repo": "github-repo";
}>;
export type UniversalGitPreset = z.infer<typeof UniversalGitPreset>;
/**
 * Credential type for the git clone step. `pat` and `basic` both use HTTPS
 * Basic auth (PAT is Basic auth with user=`x-access-token` or user=`oauth2`
 * depending on forge); `ssh` uses an SSH key + `GIT_SSH_COMMAND`.
 */
export declare const UniversalGitCredentialType: z.ZodEnum<{
    basic: "basic";
    pat: "pat";
    ssh: "ssh";
}>;
export type UniversalGitCredentialType = z.infer<typeof UniversalGitCredentialType>;
/**
 * SSH host-key verification policy. `accept-new` auto-trusts the forge on
 * first connection (safe default for private ops but logs a one-time
 * warning). `pinned` requires `sshKnownHostsPem` and refuses any host key
 * that doesn't match — use for production-grade supply-chain hardening.
 */
export declare const SshHostKeyPolicy: z.ZodEnum<{
    "accept-new": "accept-new";
    pinned: "pinned";
}>;
export type SshHostKeyPolicy = z.infer<typeof SshHostKeyPolicy>;
/**
 * Reference to a secret in the orchestrator's secret store. Resolved at
 * dispatch time via `SecretResolver.resolveNamed()`. The secret itself lives
 * at scope `__source__/<sourceId>`, key = `credentialRef.key`, optionally
 * in a specific backend via `credentialRef.store` (defaults to `pg`).
 */
export declare const CredentialRefSchema: z.ZodObject<{
    key: z.ZodString;
    store: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
export type CredentialRef = z.infer<typeof CredentialRefSchema>;
/**
 * Payload extraction paths (JSONPath). Each preset supplies canonical values;
 * `custom` requires all fields to be set explicitly.
 */
export declare const UniversalGitPayloadPathsSchema: z.ZodObject<{
    repoIdentifier: z.ZodString;
    pushRef: z.ZodString;
    pushSha: z.ZodString;
    defaultBranch: z.ZodString;
    commitsAdded: z.ZodString;
    commitsModified: z.ZodString;
    commitsRemoved: z.ZodString;
}, z.core.$strip>;
export type UniversalGitPayloadPaths = z.infer<typeof UniversalGitPayloadPathsSchema>;
/**
 * Header-to-event-name mapping. Most forges send an `X-Event-Type`-style
 * header; a few send different names for the same semantic event (e.g.
 * Gogs sends `push` while GitLab sends `Push Hook`). The universal-git
 * normalizer uses this map to collapse forge-specific values into the
 * kici-internal `push` / `pull_request` / ... event names.
 */
export declare const EventMappingSchema: z.ZodObject<{
    push: z.ZodArray<z.ZodString>;
    pullRequest: z.ZodArray<z.ZodString>;
}, z.core.$strip>;
export type EventMapping = z.infer<typeof EventMappingSchema>;
/**
 * Complete universal-git configuration stored in `generic_webhook_sources.git_config`.
 *
 * Validation refinements (enforced by Zod):
 *   - `credentialType === 'ssh'` implies `credentialUser` is unused (ignored).
 *   - `sshHostKeyPolicy === 'pinned'` requires `sshKnownHostsPem`.
 *   - `preset === 'custom'` requires explicit `payloadPaths` and `eventMapping`.
 *   - Non-custom presets ignore caller-supplied `payloadPaths` / `eventMapping`
 *     in favour of the preset defaults (see `expandUniversalGitConfig`).
 */
export declare const UniversalGitConfigSchema: z.ZodObject<{
    preset: z.ZodEnum<{
        custom: "custom";
        forgejo: "forgejo";
        gitea: "gitea";
        gogs: "gogs";
        "gitlab-repo": "gitlab-repo";
        "github-repo": "github-repo";
    }>;
    gitUrlTemplate: z.ZodString;
    credentialRef: z.ZodObject<{
        key: z.ZodString;
        store: z.ZodOptional<z.ZodString>;
    }, z.core.$strip>;
    credentialType: z.ZodEnum<{
        basic: "basic";
        pat: "pat";
        ssh: "ssh";
    }>;
    credentialUser: z.ZodOptional<z.ZodString>;
    sshHostKeyPolicy: z.ZodDefault<z.ZodEnum<{
        "accept-new": "accept-new";
        pinned: "pinned";
    }>>;
    sshKnownHostsPem: z.ZodOptional<z.ZodString>;
    payloadPaths: z.ZodOptional<z.ZodObject<{
        repoIdentifier: z.ZodString;
        pushRef: z.ZodString;
        pushSha: z.ZodString;
        defaultBranch: z.ZodString;
        commitsAdded: z.ZodString;
        commitsModified: z.ZodString;
        commitsRemoved: z.ZodString;
    }, z.core.$strip>>;
    eventMapping: z.ZodOptional<z.ZodObject<{
        push: z.ZodArray<z.ZodString>;
        pullRequest: z.ZodArray<z.ZodString>;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type UniversalGitConfig = z.infer<typeof UniversalGitConfigSchema>;
/**
 * Canonical preset definitions. Expanded into full `payloadPaths` +
 * `eventMapping` by `expandUniversalGitConfig`. Every forge in this table
 * emits push / PR payloads that are structurally identical to GitHub's at
 * the fields we care about (repository.full_name, commits[].added, etc.).
 *
 * `webhookEventHeader` is the HTTP header each forge sets on outbound
 * webhook deliveries to communicate the event type. It is consumed by the
 * generic webhook ingester (`generic_webhook_sources.event_type_header`) to
 * classify the event before passing it to the universal-git normalizer. The
 * source manager auto-populates the row's `event_type_header` from this
 * field when an operator picks a preset and does not override the header
 * explicitly.
 */
export declare const UNIVERSAL_GIT_PRESETS: Record<Exclude<UniversalGitPreset, 'custom'>, {
    payloadPaths: UniversalGitPayloadPaths;
    eventMapping: EventMapping;
    webhookEventHeader: string;
}>;
/**
 * Resolve the canonical webhook event-type header for a preset. Returns
 * `null` when the preset is `custom` (operator must supply the header
 * explicitly via `eventTypeHeader`).
 */
export declare function presetWebhookEventHeader(preset: UniversalGitPreset): string | null;
/**
 * Expand a validated `UniversalGitConfig` into a form where `payloadPaths`
 * and `eventMapping` are always populated. Non-custom presets pull from
 * `UNIVERSAL_GIT_PRESETS`; `custom` passes through the caller-supplied
 * values (Zod has already enforced that both are present).
 */
export declare function expandUniversalGitConfig(config: UniversalGitConfig): UniversalGitConfig & {
    payloadPaths: UniversalGitPayloadPaths;
    eventMapping: EventMapping;
};
/**
 * Parse a raw value (e.g. `git_config` JSONB from the DB) into a validated
 * `UniversalGitConfig`. Returns `null` when the input is null/undefined;
 * throws a ZodError on any other invalid shape.
 */
export declare function parseUniversalGitConfig(raw: unknown): UniversalGitConfig | null;
/**
 * Safe-parse variant. Returns `{ ok: true, config }` on success, or
 * `{ ok: false, error }` on validation failure. Null/undefined inputs
 * produce `{ ok: true, config: null }`.
 */
export declare function safeParseUniversalGitConfig(raw: unknown): {
    ok: true;
    config: UniversalGitConfig | null;
} | {
    ok: false;
    error: z.ZodError;
};
//# sourceMappingURL=config.d.ts.map