/**
 * Backup bundle inspect primitives (SDK).
 *
 * Manifest parsing helpers and exact read-only observation inspection.
 *
 * Manifest helpers were extracted from
 * `packages/cleo/src/cli/commands/backup-inspect.ts` per the AGENTS.md
 * Package-Boundary Check (T9985 / E8-CLI-LAYERING). The snapshot inspector
 * accepts explicit paths, validates a private copy through the canonical opener,
 * and returns provenance without live-store routing or CLI rendering.
 *
 * The CLI command file retains the orchestrator (`inspectAction`,
 * `inspectTarball`, `printInspectReport`) because those bind to
 * {@link cliError}, {@link humanLine}, and `process.exitCode`.
 *
 * Spec: T311-backup-portability-spec.md §5.3.
 *
 * @task T9985
 * @epic T9985 (E8-CLI-LAYERING)
 * @saga T9977 (SG-WORKTRUNK-OWN)
 * @see packages/cleo/src/cli/commands/backup-inspect.ts — CLI orchestrator
 */
import type { BackupObservationInspectFailure, BackupObservationInspection, BackupObservationInspectOptions } from '@cleocode/contracts/backup-manifest';
/** Magic string that identifies a CLEO encrypted bundle (ASCII "CLEOENC1"). */
export declare const CLEO_ENC_MAGIC = "CLEOENC1";
/** Byte offset of the format-version byte in the encrypted header. */
export declare const ENC_VERSION_OFFSET = 8;
/** Supported encrypted-bundle format version. */
export declare const ENC_VERSION_SUPPORTED = 1;
/** Total fixed overhead of the encrypted bundle header (76 bytes) + auth tag (16 bytes). */
export declare const ENC_MIN_LENGTH: number;
/**
 * Reads `manifest.json` from an already-decompressed tar buffer (i.e., the
 * raw tar bytes after gunzip). Stops as soon as the entry is found, honoring
 * the spec requirement that `manifest.json` MUST be the first entry.
 *
 * Returns `null` if the entry is not found in the buffer.
 *
 * @param tarBuf - Raw (uncompressed) tar bytes.
 * @returns UTF-8 content of `manifest.json`, or `null` if not found.
 * @task T363
 * @epic T311
 * @public
 */
export declare function extractManifestFromTar(tarBuf: Buffer): string | null;
/**
 * Verifies `manifest.json` content against its embedded `integrity.manifestHash`.
 *
 * Per spec §4.2 Layer 2: the hash is SHA-256 of the manifest JSON with
 * `manifestHash` set to `""`, then hex-encoded.
 *
 * @param raw - Raw manifest.json UTF-8 string as extracted from the bundle.
 * @param manifest - Parsed manifest object.
 * @returns `true` if the hash matches; `false` if tampered or field absent.
 * @task T363
 * @epic T311
 * @public
 */
export declare function verifyManifestHash(raw: string, manifest: Record<string, unknown>): boolean;
/**
 * Formats a byte count into a human-readable string (B, KB, MB).
 *
 * @param bytes - Raw byte count.
 * @returns Formatted string such as `"5.0 MB"` or `"512 B"`.
 * @task T363
 * @epic T311
 * @public
 */
export declare function fmtBytes(bytes: number): string;
/**
 * Tests whether the file at `filePath` starts with the CLEO encrypted bundle
 * magic bytes ("CLEOENC1"). Reads only 8 bytes.
 *
 * @param filePath - Absolute path to the bundle file.
 * @returns `true` if the file is an encrypted CLEO bundle.
 * @task T363
 * @epic T311
 * @public
 */
export declare function detectEncryption(filePath: string): boolean;
/**
 * Explicit inspection failure; callers must not translate this into not-found.
 *
 * @remarks
 * The code describes a refusal or failed diagnostic within the requested snapshot
 * scope. It does not establish whether the historical record exists elsewhere.
 */
export declare class BackupObservationInspectionError extends Error {
    readonly code: BackupObservationInspectFailure;
    /**
     * Construct a scoped inspection diagnostic.
     * @param code - Stable failure category.
     * @param message - Specific refusal or observed failure.
     * @remarks No error category establishes absence of the requested record.
     * @example
     * ```ts
     * throw new BackupObservationInspectionError('SOURCE_CHANGED', 'Snapshot changed during copy.');
     * ```
     */
    constructor(code: BackupObservationInspectFailure, message: string);
}
/**
 * Inspect one exact historical observation without opening or restoring a live store.
 * @param options - Explicit snapshot identity, record ID and byte ceilings.
 * @returns Scoped authentic payload and provenance, or scoped not-found.
 * @throws BackupObservationInspectionError - The source, schema, identity or bounds are unproven.
 * @remarks O_NOFOLLOW protects source identity; O_NOATIME is requested as a
 * best effort where the platform defines it (Linux). Elsewhere (macOS) the copy
 * read may itself advance the access time, so the result reports
 * `atimeIsolation: 'unavailable'`, `atimeChanged: null` and a limitation line
 * instead of attributing the change to another reader. Access-time changes are reported
 * separately from content changes and never restored. Platforms without
 * O_NOFOLLOW (Windows) fail explicitly. Queries are synchronous
 * and are not claimed to be preemptible;
 * source/payload sizes and indexed exact lookups bound the accepted workload.
 * @example
 * ```ts
 * const evidence = await inspectBackupObservation({
 *   snapshotPath: '/authorized/backups/tasks-20260919-120000.db',
 *   recordId: 'O-mspmgvbg-0',
 * });
 * // evidence.status concerns only evidence.inspectedTables in this snapshot.
 * ```
 */
export declare function inspectBackupObservation(options: BackupObservationInspectOptions): Promise<BackupObservationInspection>;
//# sourceMappingURL=backup-inspect.d.ts.map