import { type BundleManifestFile } from "./manifest.js";
/**
 * Bytes backed by an ArrayBuffer this process owns.
 *
 * Spelled out rather than left as a bare `Uint8Array` because readFileSync and
 * the compressors return views over pooled buffers, and letting one of those
 * outlive the call is how a view ends up describing bytes that belong to
 * something else.
 */
export type OwnedBytes = Uint8Array<ArrayBuffer>;
export declare function ownBytes(view: Uint8Array | ArrayBuffer): OwnedBytes;
export interface BundleEntry {
    path: string;
    bytes: OwnedBytes;
    mode: number;
}
export interface CollectedBundle {
    entries: BundleEntry[];
    files: BundleManifestFile[];
    bundleDigest: string;
    unpackedBytes: number;
}
/**
 * Walk a bundle directory into archive-ordered entries.
 *
 * Symlinks are skipped rather than followed or recorded: a recorded link can
 * point outside the extraction root, and following one can pull a whole home
 * directory into a bundle through a stray link in a scripts folder. The mode of
 * every surviving file is NORMALISED, not copied — `scripts/**` becomes 0700
 * and everything else 0600, so the digest cannot change because someone's umask
 * differed.
 */
export declare function collectBundleEntries(dir: string): BundleEntry[];
/**
 * Refuse to pack a tree that contains credential material.
 *
 * `scrubSecrets` is the write-path scrubber used everywhere else in loops; here
 * it is used as a DETECTOR rather than a filter — if scrubbing would change any
 * byte, the file holds something that must not travel into an immutable,
 * fleet-readable artifact, and the push is refused.
 *
 * There is deliberately no `--allow-secrets`. Scrubbing on the way in would
 * publish a bundle whose scripts no longer work; the fix is always to remove
 * the credential or externalise it. The offending VALUE is never echoed — only
 * the path and the byte offset of the first divergence, which is enough to find
 * it and not enough to leak it.
 */
export declare function assertNoCredentials(entries: readonly BundleEntry[]): void;
/** Manifest file entries for a collected set, in the digest's canonical order. */
export declare function manifestFilesFor(entries: readonly BundleEntry[]): BundleManifestFile[];
/** Collect + cap-check + credential-scan a directory, without compressing it. */
export declare function collectBundle(dir: string): CollectedBundle;
export interface PackedBundle extends CollectedBundle {
    /** The `bundle.tar.zst` bytes. */
    archive: OwnedBytes;
    /** sha-256 of `archive` — the transport identity. */
    archiveSha256: string;
}
/** Compress a collected set into `bundle.tar.zst`. Reproducible for a given zstd build. */
export declare function packBundleEntries(collected: CollectedBundle): PackedBundle;
export declare function packBundle(dir: string): PackedBundle;
export declare function writeTar(entries: readonly BundleEntry[]): OwnedBytes;
export declare function concat(chunks: readonly Uint8Array[]): OwnedBytes;