import { type ReleaseRecord } from "../lifecycle/release-ledger.js";
import type { DriverStepRecord } from "./driver.js";
/**
 * Extract the artifact digest a component run promoted, by scanning its step
 * records for the last {@link isPromotedArtifact promoted-artifact} output (a
 * publish-family result carrying a location `uri`) and taking its `digest`, so
 * a release record is only ever attempted when the run actually promoted
 * something by digest. Returns undefined when no step promoted an artifact —
 * e.g. a component whose deploy has no publish step, even if it ran
 * `generate-sbom` (whose content `digest` is not a promotion, #665) — the
 * caller treats that as "nothing to record", not an error. Used by the
 * local-executor CLI path, which has the full `DriverStepRecord[]` from
 * `runComponentDeploy`.
 */
export declare function extractRunDigest(records: DriverStepRecord[]): string | undefined;
/**
 * Same digest extraction as `extractRunDigest`, but over a component
 * Temporal workflow's returned `phaseOutputs` (`{ [phase]: output }`) instead
 * of a `DriverStepRecord[]` — the shape `handle.result()` resolves to for a
 * COMPLETED component workflow (see lexicons/temporal/src/component-op/
 * serializer.ts's generated `return { phaseOutputs, componentOutputs }`).
 * Used by the `--temporal` CLI path, which never sees individual step
 * records (those exist only inside the workflow/activities).
 */
export declare function extractRunDigestFromPhaseOutputs(phaseOutputs: Record<string, Record<string, unknown>> | undefined): string | undefined;
/** Explicit reasons `maybeRecordAutoRelease` declined to write a record — never a thrown error, since "nothing to record" (or "opted out") is an expected, common outcome. */
export type AutoReleaseSkipReason = "opted-out" | "run-not-successful" | "no-digest" | "no-actor";
export type AutoReleaseResult = {
    recorded: true;
    commit: string;
    record: ReleaseRecord;
} | {
    recorded: false;
    reason: AutoReleaseSkipReason;
    detail?: string;
} | {
    recorded: false;
    reason: "error";
    error: string;
};
/** Input describing one component's completed run, common to both the local-executor and Temporal-durable CLI paths. */
export interface AutoReleaseRunInfo {
    component: string;
    env: string;
    /** Whether the run reported overall success — `DriverRunResult.ok` (local) or a terminal `COMPLETED` Temporal status. A caller must not call this for a non-terminal/in-progress run. */
    success: boolean;
    /** The component's step records (local executor), used to locate the published digest via `extractRunDigest`. Mutually exclusive with `digest` — pass whichever the caller already has. */
    records?: DriverStepRecord[];
    /** A digest already resolved by the caller (e.g. the `--temporal` path, via `extractRunDigestFromPhaseOutputs` over the workflow's `handle.result()`). Takes precedence over `records` when both are given. */
    digest?: string;
    /** Orchestrator run identifier — a Temporal `runId`, or a locally generated id for the local executor (mirrors `runComponentsReleaseRecord`'s `--run-id` default). */
    runId: string;
}
/** Opt-out + field-override knobs for auto-release recording, threaded from CLI flags/config (#597: "opt-out-able (flag/config), documented default"). */
export interface AutoReleaseOptions {
    /** `--no-release-record` / `chant.config.ts`'s `release.autoRecord: false` — skip emission entirely. Default: emission is ON. */
    disabled?: boolean;
    /** Override the git sha to record (tests, or a caller that already resolved it). Defaults to `git rev-parse HEAD`. */
    gitSha?: string;
    /** Override the actor to record. Defaults to `$GITHUB_ACTOR`/`$GITLAB_USER_LOGIN`/`$USER`, matching `runComponentsReleaseRecord`. */
    actor?: string;
    /** Working directory for the git plumbing calls (tests). */
    cwd?: string;
}
/**
 * After a successful `chant run --components <name> --env <env>` (local or
 * `--temporal`), append exactly one immutable release record to the ledger
 * and push it — or explain, without throwing, why it didn't. Never called
 * for a failed run (`run.success` must be true before the caller invokes
 * this at all; see `runOpComponents`/`runComponentTemporal`) — a failed
 * deploy writes nothing, by construction, since this function is simply
 * never reached on that path.
 *
 * Skips (returns `{ recorded: false, reason }`, never throws for these
 * expected cases):
 *  - `options.disabled` — the opt-out flag/config was set.
 *  - `run.success` false — defensive; callers should not reach here on failure.
 *  - no digest found in the run's records — a component with no publish step
 *    has nothing to bind a release record to.
 *  - no resolvable actor — mirrors `runComponentsReleaseRecord`'s hard
 *    requirement; an unattributed record defeats the ledger's purpose.
 *
 * Git-sha resolution failure and ledger-write failures
 * (`InvalidReleaseRecordError`, `StaleLifecycleBranchError`, or any other
 * error `appendReleaseRecord`/`pushLifecycle` throw) are reported as `{
 * recorded: false, reason: "error", error }` rather than propagated — an
 * auto-recorded ledger write is a best-effort observability side effect of a
 * successful deploy; it must never turn a successful `chant run --components`
 * into a failing CLI invocation. The caller should still surface the message
 * as a warning.
 */
export declare function maybeRecordAutoRelease(run: AutoReleaseRunInfo, options?: AutoReleaseOptions): Promise<AutoReleaseResult>;
//# sourceMappingURL=auto-release.d.ts.map