/**
 * Promoted-artifact checks shared by delivery/authority readiness.
 * @module cli/doctor-readiness-promoted-artifact
 */
import type { ParsedWorkflowJob, ParsedWorkflowStep } from "./doctor-readiness-workflows.js";
import type { ReleasePathOutcome } from "./doctor-readiness-release-path.js";
/** The GitHub Actions promotion step Lisa recognizes for CI-built artifacts. */
export declare const PROMOTION_ACTION = "actions/download-artifact";
/**
 * Whether an action step publishes something externally.
 * @param step - The step to classify
 * @returns True when the action is a known publishing action
 */
export declare function isPublishAction(step: ParsedWorkflowStep): boolean;
/**
 * Whether an action reference is the trusted artifact-promotion action.
 * @param uses - Raw action reference
 * @returns True when the action id is exactly actions/download-artifact
 */
export declare function isPromotionAction(uses: string): boolean;
/**
 * Whether the job promotes an artifact produced by another job.
 * @param job - The publishing job
 * @param publishStep - The step that ships
 * @param ancestorJobs - Jobs in the publishing job's `needs:` closure
 * @returns True when a download-artifact step is present before publication
 */
export declare function promotesValidatedArtifact(job: ParsedWorkflowJob, publishStep: ParsedWorkflowStep, ancestorJobs?: readonly ParsedWorkflowJob[]): boolean;
/**
 * Whether a named artifact download disagrees with named ancestor uploads.
 * @param job - The publishing job
 * @param publishStep - The step that ships
 * @param ancestorJobs - Jobs in the publishing job's `needs:` closure
 * @returns True when the downloaded artifact name is not uploaded by any ancestor
 */
export declare function hasArtifactNameMismatch(job: ParsedWorkflowJob, publishStep: ParsedWorkflowStep, ancestorJobs: readonly ParsedWorkflowJob[]): boolean;
/**
 * Whether a named promotion verifies the downloaded artifact's identity before
 * publication. A matching artifact name proves a useful link, but a digest or
 * attestation check is the offline evidence that the bytes were not swapped.
 * @param job - The publishing job
 * @param publishStep - The step that ships
 * @param ancestorJobs - Jobs in the publishing job's `needs:` closure
 * @returns True when a named promotion lacks digest/attestation verification
 */
export declare function hasUnprovenArtifactIntegrity(job: ParsedWorkflowJob, publishStep: ParsedWorkflowStep, ancestorJobs: readonly ParsedWorkflowJob[]): boolean;
/**
 * The release job downloaded a named artifact different from anything a
 * validating ancestor uploaded, so the shipped bytes are not the tested bytes.
 * @param where - Evidence location label
 * @returns The violation outcome
 */
export declare function artifactNameMismatch(where: string): ReleasePathOutcome;
/**
 * A named artifact promotion exists, but no digest/attestation check proves the
 * downloaded bytes are the same bytes the validating job uploaded.
 * @param where - Evidence location label
 * @returns The unresolved outcome
 */
export declare function unresolvedArtifactIntegrity(where: string): ReleasePathOutcome;
/**
 * A downloaded artifact without linked validation is unestablished, not clean.
 * @param where - Evidence location label
 * @returns The unresolved outcome
 */
export declare function unresolvedPromotedArtifact(where: string): ReleasePathOutcome;
//# sourceMappingURL=doctor-readiness-promoted-artifact.d.ts.map