/**
 * `cleo provenance verify <version>` — Phase 2 of T9493 (T9529).
 *
 * Audits the 11 provenance tables for a given release tag. Every junction-table
 * row MUST resolve to a real parent row (FK integrity), no orphan rows MAY
 * exist for the release, and ADR-051 evidence atoms recorded at plan time MUST
 * still be reachable from the tag.
 *
 * Design (read-only):
 *
 *   - Loads the release row by `version` from `releases` (the unified table).
 *   - For each junction table associated with the release (`release_commits`,
 *     `task_commits` for that release's commits, `pr_commits`, `pr_tasks`,
 *     `release_changes`, `release_artifacts`), runs a LEFT JOIN query and
 *     collects rows whose parent is missing.
 *   - For each `evidence_atom` in `<version>.plan.json` of kind `commit:<sha>`,
 *     runs `git merge-base --is-ancestor <sha> <tag>` and records non-zero
 *     exits as "stale".
 *   - Aggregates 8 categories into the `data.categories` envelope, sets
 *     `data.passed = false` iff ANY category failed, and propagates to the
 *     outer LAFS `success` flag.
 *
 * @task T9529
 * @epic T9493
 * @adr  ADR-T9345 (IVTR-release-overhaul)
 * @spec .cleo/rcasd/T9345/research/SPEC-T9345-release-pipeline-v2.md §4.6
 * @spec .cleo/rcasd/T9345/research/provenance-graph-design.md §11
 */
import { type EngineResult } from '../engine-result.js';
/**
 * Options for {@link verifyProvenance}.
 *
 * Either `version` MUST be supplied (single-release mode) or `all: true`
 * (most-recent-N mode). When both are supplied, `version` wins.
 */
export interface VerifyProvenanceOptions {
    /** Specific release version string (e.g. `v2026.6.0`). */
    version?: string;
    /** When true, verifies the most-recent `limit` releases. */
    all?: boolean;
    /** Number of releases to verify in `--all` mode (default 5). */
    limit?: number;
    /** Project root override (defaults to CLEO_ROOT or cwd). */
    projectRoot?: string;
}
/** One stale evidence atom — surfaced verbatim to the caller. */
export interface StaleEvidenceAtom {
    /** Task ID whose evidence atom failed reachability. */
    taskId: string;
    /** The atom string as it appeared in `plan.tasks[].evidenceAtoms`. */
    atom: string;
    /** Human-readable explanation (e.g. "commit X not reachable from tag Y"). */
    reason: string;
}
/** Result envelope for ONE release version. */
export interface VerifyProvenanceCategories {
    /** Existence of the `releases` row for `<version>`. */
    releaseExists: {
        passed: boolean;
        count: number;
    };
    /** Every `release_commits.commit_sha` resolves to a real `commits.sha`. */
    commitFkIntegrity: {
        passed: boolean;
        orphanCount: number;
        orphans: string[];
    };
    /** Every `task_commits.task_id` (for this release's commits) resolves. */
    taskCommitFkIntegrity: {
        passed: boolean;
        orphanCount: number;
        orphans: string[];
    };
    /** Every `pr_commits.commit_sha` (for PRs touching this release) resolves. */
    prCommitFkIntegrity: {
        passed: boolean;
        orphanCount: number;
        orphans: string[];
    };
    /** Every `pr_tasks.task_id` (for PRs touching this release) resolves. */
    prTaskFkIntegrity: {
        passed: boolean;
        orphanCount: number;
        orphans: string[];
    };
    /** Every `release_changes` row resolves to a real task OR to NULL. */
    releaseChangesIntegrity: {
        passed: boolean;
        orphanCount: number;
    };
    /** Every `release_artifacts` row resolves to a real release. */
    releaseArtifactsIntegrity: {
        passed: boolean;
        orphanCount: number;
    };
    /** ADR-051 evidence atoms still reachable from the tag. */
    evidenceStaleness: {
        passed: boolean;
        staleAtoms: StaleEvidenceAtom[];
    };
}
/** Per-release verification verdict. */
export interface VerifyProvenanceReleaseResult {
    /** Release version string. */
    version: string;
    /** True iff every category passed. */
    passed: boolean;
    /** Per-category diagnostic detail. */
    categories: VerifyProvenanceCategories;
}
/** Result envelope for {@link verifyProvenance}. */
export interface VerifyProvenanceResult {
    /** Releases verified (length 1 in single-version mode, N in --all mode). */
    releases: VerifyProvenanceReleaseResult[];
    /** Convenience alias for `releases[0].version` in single-mode. */
    version: string;
    /** True iff EVERY release verified passed every category. */
    passed: boolean;
    /** Aggregated categories for the FIRST release in `releases[]` (single-mode). */
    categories: VerifyProvenanceCategories;
    /** Total wall-clock duration in ms. */
    durationMs?: number;
}
/**
 * Audit the 11 provenance tables for a given release (or the N most-recent
 * releases when `opts.all` is set). READ-ONLY — does not mutate the DB.
 *
 * Returns `engineSuccess(VerifyProvenanceResult)` with `data.passed === true`
 * when every category passes for every release in scope. Returns
 * `engineError('E_PROVENANCE_INCOMPLETE', ...)` with the same envelope
 * payload available under `error.details.data` when any category fails — the
 * CLI surfaces this via a non-zero exit code per the SPEC.
 *
 * @param opts — See {@link VerifyProvenanceOptions}.
 * @returns EngineResult envelope.
 */
export declare function verifyProvenance(opts: VerifyProvenanceOptions): Promise<EngineResult<VerifyProvenanceResult>>;
//# sourceMappingURL=verify-provenance.d.ts.map