/**
 * deliver-envelope — the composition root's signal-delivery step (ADR-0011,
 * Phase 3).
 *
 * After a tool returns its {@link SignalEnvelope}, the root — not the tool —
 * delivers it to the effectful sinks:
 *
 *   1. **Cloud sync (best-effort).** Map the envelope → `SignalBatch`
 *      (`@opensip-cli/core` `buildSignalBatch`, adding repo identity and
 *      preserving the envelope's `runId`/`createdAt`; dropping `verdict`/`units`
 *      — the cloud wire shape stays `schemaVersion: 1`) and emit it through the
 *      run's `scope.signalSink`. The sink is a no-op for the keyless / not-
 *      entitled majority. NEVER throws, NEVER affects the exit code (ADR-0008).
 *      Ships the envelope's signals as-is — **no SARIF detour** on this path.
 *
 *   2. **`--report-to` (owns exit code 4).** When `reportTo` is set, format the
 *      envelope to SARIF via the single shared `formatSignalSarif` formatter and
 *      POST it through the shared chunked transport (`postChunked`). An upload
 *      failure exits `EXIT_CODES.REPORT_FAILED` (4) — but only when the run
 *      otherwise passed; a real check/gate failure (`runFailed`) dominates and
 *      is never masked by a reporting failure (ADR-0008).
 *
 * This is the seam that keeps tool engines free of `@opensip-cli/output`:
 * engines return envelopes, and the composition root owns formatting,
 * delivery, and report-upload exit-code policy.
 */
import type { ArtifactWriteContext } from './atomic-artifact-write.js';
import type { SignalEnvelope } from '@opensip-cli/contracts';
import type { Logger, RepoIdentity, SignalBatch, SignalDeliveryResult } from '@opensip-cli/core';
/** Options the root supplies when delivering a tool's envelope. */
export interface DeliverEnvelopeOptions {
    /** Project / repo working directory — the repo-identity probe root. */
    readonly cwd: string;
    /** `--report-to <url>` target, when requested. */
    readonly reportTo?: string;
    /** Cloud API key for `--report-to` (read off the same flag as cloud sync). */
    readonly apiKey?: string;
    /**
     * Optional override for the findings-failure decision (ADR-0035). Normal runs
     * OMIT this — the host derives the findings exit from `envelope.verdict.passed`
     * (the single verdict). The gate-COMPARE modes pass their baseline-diff
     * predicate (`degraded`): "net-new findings since baseline" is NOT expressible
     * over the run's own verdict, so the host honours the override for that mode.
     */
    readonly runFailed?: boolean;
    /** Exit-code setter (the CLI's single write path). */
    readonly setExitCode?: (code: number) => void;
    /** Pre-resolved repo identity; resolved from `cwd` when omitted. */
    readonly repo?: RepoIdentity;
    readonly logger?: Logger;
    /** Injectable `fetch` for the `--report-to` upload (tests). */
    readonly fetchImpl?: typeof fetch;
}
/**
 * Outcome of an envelope delivery. The canonical shape is core's
 * {@link SignalDeliveryResult} (the `ToolCliContext.deliverSignals` return);
 * this alias keeps the historical local name for existing imports.
 */
export type DeliverEnvelopeResult = SignalDeliveryResult;
/**
 * Map a {@link SignalEnvelope} to the cloud {@link SignalBatch} wire shape:
 * add repo identity, preserve the run identity, drop `verdict`/`units`.
 */
export declare function envelopeToSignalBatch(envelope: SignalEnvelope, repo: RepoIdentity): SignalBatch;
/**
 * Pure host-owned findings exit policy (ADR-0035). Tools never derive this
 * themselves; they hand the host an envelope, and the host maps the single
 * verdict to the process exit.
 */
export declare function deriveFindingsExitCode(envelope: SignalEnvelope): number;
/**
 * Pure seam for the report-upload vs findings-failure exit precedence (ADR-0008 / Task 1).
 * Extracted so the matrix is unit-testable without IO / full deliverEnvelope.
 * A report failure (exit 4) is only honoured when the run otherwise passed
 * (real findings / gate / override failure always dominates; last-write-wins on RUNTIME_ERROR).
 */
export declare function deriveReportExitDecision(reportTo: string | undefined, reportSuccess: boolean, runFailed: boolean): number | undefined;
/**
 * The root's post-run signal-delivery step. Emits the envelope to the cloud
 * sink (best-effort) and, when `--report-to` is set, uploads its SARIF
 * (owning exit code 4). Never throws.
 */
export declare function deliverEnvelope(envelope: SignalEnvelope, opts: DeliverEnvelopeOptions): Promise<DeliverEnvelopeResult>;
/**
 * Root-owned SARIF-**file** sink (ADR-0011): format the envelope to SARIF via
 * the single shared `formatSignalSarif` formatter and write the bytes to
 * `path`, creating parent directories as needed. This is the seam behind
 * `ToolCliContext.writeSarif` — a tool that exports SARIF to a file (e.g.
 * `graph sarif-export`) routes through it instead of importing
 * `@opensip-cli/output` itself. The formatter is pure; this function owns
 * the effect (fs write).
 */
export declare function writeEnvelopeSarif(envelope: SignalEnvelope, path: string, artifactCtx?: Partial<ArtifactWriteContext> & {
    readonly logger?: ArtifactWriteContext['logger'];
}): Promise<void>;
//# sourceMappingURL=deliver-envelope.d.ts.map