/**
 * Universal-git lock file fetcher.
 *
 * Implements `LockFileFetcher` from `@kici-dev/engine` by shallow-cloning the
 * source repo into a temporary directory, scoped to the `^\.kici/` path
 * whitelist via git sparse-checkout. This keeps the payload tiny (tens of
 * KiB for a normal workflows bundle) even when the repo itself is large.
 *
 * Safety caps (all enforced):
 *   - **5 MiB max** for the cloned `.kici/kici.lock.json` file. Rejected
 *     with `LockFileTooLargeError` when exceeded.
 *   - **30 s timeout** on each git invocation. The wall-clock budget for
 *     an entire fetch cycle (all git calls combined) is also 30 s.
 *   - **Path whitelist `^\.kici/`.** Enforced by `sparse-checkout set
 *     --cone .kici` so nothing outside that prefix ever hits disk.
 *
 * Auth:
 *   - HTTPS Basic (PAT / basic-auth): injected via `git -c
 *     http.extraHeader=Authorization: Basic <base64>` so the secret never
 *     appears in the repo URL / logs.
 *   - SSH: materialized via `prepareSshAuthSync()` and surfaced through
 *     `GIT_SSH_COMMAND`; tempfiles are always cleaned up in a `finally`.
 *
 * This fetcher is used at two sites:
 *   - Registration: when a default-branch push arrives for a universal-git
 *     source, the processor calls `fetchLockFile(repoId, sha, credentials)`
 *     to re-read the workflow manifest.
 *   - Global-workflow dispatch: cross-provider globals resolve the lock
 *     file via the registration's provider bundle.
 */
import type { LockFileFetcher, LockFile } from '@kici-dev/engine';
import type { SecretResolver } from '../../secrets/secret-resolver.js';
import type { UniversalGitConfig } from './config.js';
/**
 * Typed error for the 5 MiB cap. Callers can differentiate this from
 * generic fetch failures for metrics / logging.
 */
export declare class LockFileTooLargeError extends Error {
    readonly repoIdentifier: string;
    readonly sizeBytes: number;
    readonly limitBytes: number;
    constructor(repoIdentifier: string, sizeBytes: number, limitBytes?: number);
}
/**
 * Universal-git implementation of LockFileFetcher.
 *
 * Bound to a single source (orgId + sourceId + config). The orchestrator
 * constructs one per registered universal-git source.
 */
export declare class UniversalGitLockFileFetcher implements LockFileFetcher {
    private readonly params;
    readonly provider: "generic";
    private readonly repoUrlBuilder;
    constructor(params: {
        orgId: string;
        sourceId: string;
        config: UniversalGitConfig;
        secretResolver: SecretResolver;
    });
    /**
     * Shallow-clone the source repo at `ref` into a private tempdir, read
     * `.kici/kici.lock.json`, and tear down.
     *
     * @returns The parsed `LockFile` on success, or `null` when the path
     * doesn't exist in the repo (i.e. user hasn't added a lock file yet).
     * Throws on any other failure — caller catches + emits
     * `kici_universal_git_registration_errors_total{reason}`.
     */
    fetchLockFile(repoIdentifier: string, ref: string, _credentials: unknown): Promise<LockFile | null>;
}
//# sourceMappingURL=lock-file.d.ts.map