/**
 * Held run store -- lifecycle management for runs held by protection gates.
 *
 * Manages the lifecycle: pending -> approved/rejected/expired.
 */
import { type Kysely } from 'kysely';
import type { Database, HeldRun } from '../db/types.js';
/** Status values for held runs (held_runs table). */
export declare enum HeldRunStatus {
    Pending = "pending",
    Approved = "approved",
    Rejected = "rejected",
    Expired = "expired",
    Released = "released"
}
/** Data required to create a held run. */
export interface CreateHeldRunData {
    runId: string;
    jobId: string;
    environmentId: string;
    holdType: string;
    reason: string;
    expiresAt: Date;
    /** Queue type: 'environment' (default) or 'security'. */
    queueType?: 'environment' | 'security';
}
/** Options for listing held runs. */
export interface ListHeldRunsOptions {
    status?: string;
    limit?: number;
}
/** Manages held run lifecycle (pending -> approved/rejected/expired). */
export declare class HeldRunStore {
    private readonly db;
    constructor(db: Kysely<Database>);
    /** Create a new held run with pending status. */
    create(orgId: string, data: CreateHeldRunData): Promise<HeldRun>;
    /** Approve a pending held run. Throws if not found or not pending. */
    approve(orgId: string, heldRunId: string, approvedBy: string): Promise<HeldRun>;
    /** Reject a pending held run. Throws if not found or not pending. */
    reject(orgId: string, heldRunId: string, reason?: string): Promise<HeldRun>;
    /** List pending held runs for an org, ordered by creation time. */
    listPending(orgId: string): Promise<HeldRun[]>;
    /** List held runs for an org with optional filters. */
    listAll(orgId: string, options?: ListHeldRunsOptions): Promise<HeldRun[]>;
    /** List held runs for an org filtered by queue type with optional filters. */
    listByQueueType(orgId: string, queueType: 'environment' | 'security', options?: ListHeldRunsOptions): Promise<HeldRun[]>;
    /**
     * Approve a pending held run, enforcing queue_type boundary.
     * Prevents environment approvals from approving security holds and vice versa.
     * Throws if not found, not pending, or queue_type mismatch.
     */
    approveByQueueType(orgId: string, heldRunId: string, approvedBy: string, queueType: 'environment' | 'security'): Promise<HeldRun>;
    /** Get a held run by run ID and job ID. Returns null if not found. */
    getByRunAndJob(orgId: string, runId: string, jobId: string): Promise<HeldRun | null>;
    /**
     * Expire overdue pending runs. Called by the stale detector.
     * Sets status to 'expired' and resolved_at to now() for all
     * pending runs past their expires_at.
     * Returns the number of expired runs.
     */
    expireOverdue(): Promise<number>;
}
//# sourceMappingURL=held-runs.d.ts.map