/**
 * Release review linkage for @hasna/skills npm releases.
 *
 * WHY THIS EXISTS
 *
 * @hasna/skills 0.10.5 and 0.10.6 reached npm without the release authority's
 * required pre-upload linkage: an independent reviewer's GO in git-prs and the
 * git-publishing intent thread, bound to the exact candidate AND to the packed
 * tarball that was uploaded. A published version cannot be unpublished, so the only
 * place a release can refuse is BEFORE the upload.
 *
 * The binding lives in the annotated release tag message, which is created
 * before the tag is pushed and is covered by the same protected-main ancestry
 * the release workflow already requires:
 *
 *   @hasna/skills 0.10.7
 *
 *   <release notes>
 *
 *   Release-Review-Agent: <registered reviewer coding-agent identity>
 *   Git-Publishing-Thread: <release intent thread id>
 *   Git-Prs-GO: <message id of the independent GO in git-prs for this candidate>
 *   Packed-SHA256: <64 lowercase hex>
 *
 * "EXACTLY" is enforced, not implied: each of the four linkage keys must appear
 * exactly once, the linkage namespace is closed (a fifth Release-Review-* /
 * Git-Publishing-* / Git-Prs-* / Packed-* key is a failure, so a field can never be silently
 * swapped for a look-alike), values are strictly shaped, and the recorded
 * Packed-SHA256 must equal the SHA-256 of the tarball this checkout actually
 * packs. There is no fallback: a missing, duplicated, malformed or mismatched
 * field refuses the release.
 *
 * The reviewer's digest must be produced with the release toolchain at the exact
 * commit (see scripts/RELEASE.md): `npm pack --ignore-scripts` in apps/skills
 * after `bun run build`, hashed with SHA-256. A digest taken from a different
 * toolchain, a different commit or a differently-built tree does not match by
 * design, and the mismatch is the gate doing its job.
 *
 * This module is pure: git and npm I/O stay in scripts/verify-release-review.ts,
 * and the release workflow runs `bun run verify:release-review` before it is
 * allowed to publish.
 */
export declare const SKILLS_RELEASE_REPOSITORY = "hasna/skills";
export declare const SKILLS_RELEASE_REPOSITORY_URL = "https://github.com/hasna/skills.git";
export declare const SKILLS_RELEASE_PACKAGE_PATH = "apps/skills";
export declare const SKILLS_RELEASE_MANIFEST_PATH = "apps/skills/package.json";
export declare const SKILLS_RELEASE_PACKAGE_NAME = "@hasna/skills";
export declare const SKILLS_RELEASE_REGISTRY = "https://registry.npmjs.org";
export declare const SKILLS_RELEASE_TAG_PREFIX = "npm/skills/v";
/** Field names carried by the annotated release tag message, in required order. */
export declare const RELEASE_REVIEW_LINKAGE_FIELDS: {
    readonly reviewerAgent: "Release-Review-Agent";
    readonly goThreadId: "Git-Publishing-Thread";
    readonly goMessageId: "Git-Prs-GO";
    readonly packedSha256: "Packed-SHA256";
};
export type ReleaseReviewLinkageFailure = {
    check: string;
    message: string;
};
export type ReleaseReviewLinkage = {
    /** The registered coding-agent identity that performed the independent review. */
    reviewerAgent: string;
    /** Release intent thread in the git-publishing lane. */
    goThreadId: string;
    /** Message id of the independent GO in git-prs bound to this exact candidate. */
    goMessageId: string;
    /** SHA-256 of the packed release tarball, lowercase hex. */
    packedSha256: string;
};
export type ReleaseReviewLinkageInput = {
    tagMessage: string;
    tag: string;
    /** `git cat-file -t refs/tags/<tag>`; must be `tag` for an annotated tag. */
    tagType: string;
    /** `git rev-parse refs/tags/<tag>^{commit}`. */
    tagCommit: string;
    /** The exact checkout being released. */
    releaseCommit: string;
    packageName: string;
    packageVersion: string;
    repositoryUrl: string | undefined;
    repositoryDirectory: string | undefined;
    registry: string | undefined;
    access: string | undefined;
    /** SHA-256 computed from the tarball this checkout packs, when packing ran. */
    packedSha256: string | undefined;
};
/** Resolve the semver a release tag carries, or undefined for any other tag. */
export declare function parseSkillsReleaseTagVersion(tag: string): string | undefined;
/**
 * Parse the four linkage fields out of the annotated release tag message.
 * Prose (subject and release notes) is allowed; the linkage namespace is not.
 */
export declare function parseReleaseReviewLinkage(tagMessage: string): {
    linkage: Partial<ReleaseReviewLinkage>;
    failures: ReleaseReviewLinkageFailure[];
};
/**
 * The complete preflight: tagged candidate identity, package binding and the
 * packed digest recorded in the tag. Returns every failure it finds so one run
 * names all of them; any failure refuses the release.
 */
export declare function validateReleaseReviewLinkage(input: ReleaseReviewLinkageInput): ReleaseReviewLinkageFailure[];