/**
 * /kici approve and /kici reject comment command handler.
 *
 * Parses issue_comment webhook bodies for /kici commands and handles
 * approval/rejection of security holds. Verifies commenter identity
 * via the trust policy cache and checks ci_trust:write+ before acting.
 */
import type { HeldRunStore } from '../environments/held-runs.js';
import { type IdentityLink, type PermissionLevel } from './trust-resolver.js';
import type { CheckStatusPoster as EngineCheckStatusPoster } from '@kici-dev/engine';
/** Parsed /kici command from a comment body. */
interface CommentCommand {
    action: 'approve' | 'reject';
    /** Optional: specific run to approve/reject. */
    runId?: string;
}
/** Parameters for the approval comment handler. */
export interface HandleApprovalCommentParams {
    commentBody: string;
    commenterUsername: string;
    /**
     * Commenter immutable IDP-side numeric id from the webhook event. Used to
     * match the identity link by id first, falling back to username during the
     * backfill window (see trust-resolver.findIdentityLink).
     */
    commenterUserId?: string;
    provider: string;
    repoIdentifier: string;
    prNumber: number;
    orgId: string;
    identityLinks: IdentityLink[];
    orgMemberPermissions: Map<string, PermissionLevel>;
    heldRunStore: HeldRunStore;
    /** Check status poster for updating GitHub checks after approval/rejection. */
    checkStatusPoster?: EngineCheckStatusPoster;
    /** Commit SHA for the PR head (needed for check status updates). */
    commitSha?: string;
    credentials: unknown;
}
/** Result of handling a comment. */
interface HandleApprovalResult {
    handled: boolean;
    reason?: string;
}
/**
 * Parse a comment body for /kici commands.
 *
 * Looks for `/kici approve` or `/kici reject` at the start of any line.
 * Case-insensitive for the command word (approve/reject) but the /kici prefix is exact.
 * Optional run ID follows the command.
 *
 * @returns Parsed command or null if no /kici command found.
 */
export declare function parseKiciCommand(commentBody: string): CommentCommand | null;
/**
 * Handle an approval comment from a PR.
 *
 * Flow:
 * 1. Parse comment for /kici command
 * 2. Look up commenter's identity link via trust policy cache
 * 3. Check ci_trust level (must be write+)
 * 4. Find held runs for the PR
 * 5. Approve or reject held runs
 */
export declare function handleApprovalComment(params: HandleApprovalCommentParams): Promise<HandleApprovalResult>;
export {};
//# sourceMappingURL=comment-handler.d.ts.map