/**
 * Workflow invocation service.
 *
 * Encapsulates the business logic for starting a workflow by type:
 * config lookup, role/scope enforcement, principal resolution,
 * envelope building, and Durable client start.
 *
 * Transport-agnostic — called by HTTP routes, CLI, or other transports.
 */
export interface InvocationAuthContext {
    /** JWT or API-key userId (external_id or UUID). */
    userId: string;
    /** High-level role from auth middleware (e.g. 'admin', 'superadmin'). */
    role?: string;
    /** Bot API key scopes (empty for human JWTs). */
    scopes?: string[];
}
export interface InvokeWorkflowInput {
    workflowType: string;
    data: Record<string, any>;
    metadata?: Record<string, any>;
    /** Per-request execute_as override (admin-only). */
    executeAs?: string;
    /**
     * Passthrough options forwarded to `Durable.Client.workflow.start()`.
     * Any WorkflowOptions field (workflowId, expire, entity, namespace,
     * search, signalIn, pending, etc.) can be set here. The service
     * applies defaults for workflowId, expire, entity, taskQueue, and
     * workflowName when not provided.
     *
     * @see https://docs.hotmesh.io/types/types_durable.WorkflowOptions.html
     */
    options?: Record<string, any>;
    auth: InvocationAuthContext;
}
export interface InvokeWorkflowResult {
    workflowId: string;
}
export declare class InvocationError extends Error {
    readonly statusCode: number;
    constructor(message: string, statusCode: number);
}
/**
 * Start a workflow by its registered type.
 *
 * Thin proxy over `Durable.Client.workflow.start()` — callers have
 * access to the full option set (workflowId, expire, entity) with
 * sensible defaults when omitted. The service resolves the task queue,
 * enforces auth/scope constraints, builds the LTEnvelope with IAM
 * context, and delegates to the Durable client.
 *
 * Throws `InvocationError` with an appropriate status code on failure.
 */
export declare function invokeWorkflow(input: InvokeWorkflowInput): Promise<InvokeWorkflowResult>;
/**
 * Check invocation_roles when present on a workflow config.
 * Throws InvocationError if the user lacks the required role.
 */
export declare function checkInvocationRoles(workflowType: string, userId: string, authRole?: string): Promise<void>;