/**
 * Backup bundle inspect primitives (SDK).
 *
 * Pure manifest-parsing helpers extracted from
 * `packages/cleo/src/cli/commands/backup-inspect.ts` per the AGENTS.md
 * Package-Boundary Check (T9985 / E8-CLI-LAYERING). These functions never
 * touch process state, citty, or any CLI renderer — they read raw buffers
 * and return values, so they are unit-testable without spinning up the CLI.
 *
 * The CLI command file retains the orchestrator (`inspectAction`,
 * `inspectTarball`, `printInspectReport`) because those bind to
 * {@link cliError}, {@link humanLine}, and `process.exitCode`.
 *
 * Spec: T311-backup-portability-spec.md §5.3.
 *
 * @task T9985
 * @epic T9985 (E8-CLI-LAYERING)
 * @saga T9977 (SG-WORKTRUNK-OWN)
 * @see packages/cleo/src/cli/commands/backup-inspect.ts — CLI orchestrator
 */
/** Magic string that identifies a CLEO encrypted bundle (ASCII "CLEOENC1"). */
export declare const CLEO_ENC_MAGIC = "CLEOENC1";
/** Byte offset of the format-version byte in the encrypted header. */
export declare const ENC_VERSION_OFFSET = 8;
/** Supported encrypted-bundle format version. */
export declare const ENC_VERSION_SUPPORTED = 1;
/** Total fixed overhead of the encrypted bundle header (76 bytes) + auth tag (16 bytes). */
export declare const ENC_MIN_LENGTH: number;
/**
 * Reads `manifest.json` from an already-decompressed tar buffer (i.e., the
 * raw tar bytes after gunzip). Stops as soon as the entry is found, honoring
 * the spec requirement that `manifest.json` MUST be the first entry.
 *
 * Returns `null` if the entry is not found in the buffer.
 *
 * @param tarBuf - Raw (uncompressed) tar bytes.
 * @returns UTF-8 content of `manifest.json`, or `null` if not found.
 * @task T363
 * @epic T311
 * @public
 */
export declare function extractManifestFromTar(tarBuf: Buffer): string | null;
/**
 * Verifies `manifest.json` content against its embedded `integrity.manifestHash`.
 *
 * Per spec §4.2 Layer 2: the hash is SHA-256 of the manifest JSON with
 * `manifestHash` set to `""`, then hex-encoded.
 *
 * @param raw - Raw manifest.json UTF-8 string as extracted from the bundle.
 * @param manifest - Parsed manifest object.
 * @returns `true` if the hash matches; `false` if tampered or field absent.
 * @task T363
 * @epic T311
 * @public
 */
export declare function verifyManifestHash(raw: string, manifest: Record<string, unknown>): boolean;
/**
 * Formats a byte count into a human-readable string (B, KB, MB).
 *
 * @param bytes - Raw byte count.
 * @returns Formatted string such as `"5.0 MB"` or `"512 B"`.
 * @task T363
 * @epic T311
 * @public
 */
export declare function fmtBytes(bytes: number): string;
/**
 * Tests whether the file at `filePath` starts with the CLEO encrypted bundle
 * magic bytes ("CLEOENC1"). Reads only 8 bytes.
 *
 * @param filePath - Absolute path to the bundle file.
 * @returns `true` if the file is an encrypted CLEO bundle.
 * @task T363
 * @epic T311
 * @public
 */
export declare function detectEncryption(filePath: string): boolean;
//# sourceMappingURL=backup-inspect.d.ts.map