/**
 * TrustResolver -- combines identity links, RBAC ci_trust, and provider permissions
 * into a trust tier decision.
 *
 * The TrustResolver is the core decision engine for CI security. It determines
 * whether a contributor is trusted, known, or unknown based on:
 * 1. Identity link lookup (provider username -> KiCI user ID)
 * 2. ci_trust RBAC level for that user in the org
 * 3. Provider API permission (via ContributorResolver + cache)
 */
import type { ContributorPermission, ContributorResolver } from '@kici-dev/engine';
import type { TrustTier } from '@kici-dev/engine';
import type { ContributorCache } from './contributor-cache.js';
/**
 * Match an identity link strictly by `(provider, providerUserId)`.
 *
 * Returns `null` whenever the numeric id is missing on either side or when no
 * link's id matches the event's id. This is the strict end-state contract:
 * username fallback is gone, mutable-username impersonation cannot grant
 * trust, and a refused match is recorded under
 * `kici_orch_trust_match_refused_no_id_total{reason}` so the rate of refusals
 * stays observable.
 *
 * Pre-conditions for callers: Platform's reconcile job has filled
 * `provider_user_id` for every row in `identity_links` (verified by the
 * `kici_platform_identity_links_missing_provider_user_id` gauge being 0 for
 * ≥4 cycles before this strict policy was deployed). See
 * `.claude/plans/cryptic-jumping-narwhal.md` for the rollout journey.
 */
export declare function findIdentityLink(identityLinks: IdentityLink[], provider: string, providerUsername: string, providerUserId: string | undefined): IdentityLink | null;
/** RBAC permission levels from the Platform permission system. */
export type PermissionLevel = 'none' | 'read' | 'write' | 'admin';
/** Identity link mapping a provider identity to a KiCI user. */
export interface IdentityLink {
    userId: string;
    provider: string;
    providerUsername: string;
    /**
     * Immutable IDP-side numeric id (e.g. GitHub's `sender.id`).
     * Nullable during the backfill window for legacy rows that
     * predate Platform migration 009. Trust resolver matches on
     * this field first; once backfill completes the strict policy
     * refuses trust when this is null.
     */
    providerUserId?: string | null;
}
/** Parameters for trust tier resolution. */
interface TrustResolutionParams {
    /** Sender username from the webhook event. */
    providerUsername: string;
    /**
     * Sender immutable IDP-side numeric id from the webhook event (e.g.
     * GitHub's `sender.id` coerced to string). Optional during the backfill
     * window; the strict end-state refuses trust when this is missing.
     */
    providerUserId?: string;
    /** Provider type (e.g. 'github'). */
    provider: string;
    /** Repository identifier (e.g. 'owner/repo'). */
    repoIdentifier: string;
    /** Whether the PR comes from a fork. */
    isForkPR: boolean;
    /** Organization ID this webhook routes to. */
    orgId: string;
    /** Cached identity links from Platform push. */
    identityLinks: IdentityLink[];
    /** ci_trust permission levels per user ID from Platform push. */
    orgMemberPermissions: Map<string, PermissionLevel>;
    /** Provider-specific contributor resolver. */
    contributorResolver: ContributorResolver;
    /** Credentials for provider API calls. */
    credentials: unknown;
}
/** Result of trust tier resolution with full audit trail. */
export interface TrustResolution {
    tier: TrustTier;
    contributorUsername: string;
    identityLinked: boolean;
    userId?: string;
    providerPermission: ContributorPermission;
    ciTrustLevel?: PermissionLevel;
    reason: string;
}
/**
 * TrustResolver combines identity links, ci_trust RBAC, and provider permissions
 * into a trust tier.
 *
 * Decision matrix:
 * 1. Fork PR -> always unknown
 * 2. No identity link -> provider API fallback (never trusted)
 *    - read+ -> known
 *    - none -> unknown
 * 3. Identity linked -> combine ci_trust + provider permission:
 *    - provider write+ AND ci_trust write+ -> trusted
 *    - provider write+ AND ci_trust none/read -> known
 *    - provider read -> known
 *    - provider none -> unknown
 */
export declare class TrustResolver {
    private readonly contributorCache;
    constructor(contributorCache: ContributorCache);
    /**
     * Resolve the trust tier for a contributor.
     */
    resolveTrustTier(params: TrustResolutionParams): Promise<TrustResolution>;
}
export {};
//# sourceMappingURL=trust-resolver.d.ts.map