/**
 * Hash-Chain Verification for Provenance
 *
 * Creates a tamper-evident Merkle-like chain where each provenance record
 * includes SHA-256(content_hash + parent.chain_hash).
 *
 * CRITICAL: NEVER use console.log() - stdout is reserved for JSON-RPC protocol.
 *
 * @module services/provenance/chain-hash
 */
import type Database from 'better-sqlite3';
export interface ChainVerificationResult {
    valid: boolean;
    total_records: number;
    verified: number;
    null_hash_count: number;
    broken_at: string | null;
    error?: string;
}
export interface BackfillResult {
    updated: number;
    errors: number;
}
/**
 * Compute chain hash for a provenance record.
 *
 * Chain hash = SHA-256(content_hash + ":" + parent_chain_hash)
 * For root records (no parent): SHA-256(content_hash)
 *
 * @param contentHash - The content hash of the current record
 * @param parentChainHash - The chain hash of the parent record, or null for roots
 * @returns Hex-encoded SHA-256 chain hash
 */
export declare function computeChainHash(contentHash: string, parentChainHash: string | null): string;
/**
 * Verify the chain hash integrity for all provenance records of a root document.
 *
 * Walks the provenance chain in depth-first order, recomputing each chain_hash
 * from (content_hash, parent.chain_hash) and comparing against the stored value.
 *
 * Pre-v32 records without chain_hash are counted separately as null_hash_count.
 * The result is only valid when there are zero mismatches AND zero null hashes.
 *
 * @param conn - Database connection
 * @param rootDocumentId - The root document provenance ID to verify
 * @returns Verification result with record counts and any breakage point
 */
export declare function verifyChainHashes(conn: Database.Database, rootDocumentId: string): ChainVerificationResult;
/**
 * Backfill chain hashes for existing provenance records that don't have them.
 *
 * Processes records in depth-first order (chain_depth ASC) so that parent
 * chain hashes are available when computing child hashes.
 *
 * @param conn - Database connection
 * @returns Count of updated records and errors
 */
export declare function backfillChainHashes(conn: Database.Database): BackfillResult;
//# sourceMappingURL=chain-hash.d.ts.map