/**
 * sha256sums, generate and verify a SHA256SUMS manifest over release assets.
 *
 * Emits the standard `<hex>  <name>` format (two spaces, coreutils-compatible).
 * A missing asset is a hard failure, a release must never ship an unlisted or
 * absent binary.
 */
export interface Sha256Entry {
    /** Name recorded in the manifest (typically the asset basename). */
    readonly name: string;
    /** Absolute or root-relative path to hash. */
    readonly path: string;
}
/** Reads a file's bytes; returns null when the file is absent. */
export type ReadBytes = (path: string) => Uint8Array | null;
/** Computes a lowercase hex sha256 of bytes. */
export type HashBytes = (bytes: Uint8Array) => string;
export interface Sha256SumsResult {
    readonly ok: boolean;
    /** Manifest text (only meaningful when ok). */
    readonly manifest: string;
    /** Entries whose file was missing. */
    readonly missing: readonly string[];
}
/**
 * Produce a SHA256SUMS manifest. Every entry must resolve to bytes; any missing
 * file yields ok=false and is listed in `missing`.
 */
export declare function generateSha256Sums(entries: readonly Sha256Entry[], readBytes: ReadBytes, hashBytes: HashBytes): Sha256SumsResult;
export interface VerifyResult {
    readonly ok: boolean;
    /** Names whose recomputed hash differs from the manifest. */
    readonly mismatched: readonly string[];
    /** Names present in the manifest but absent on disk. */
    readonly missing: readonly string[];
}
/** Parse a manifest into name→hash pairs. */
export declare function parseSha256Manifest(manifest: string): Map<string, string>;
/** Verify assets against a manifest by recomputing each hash. */
export declare function verifySha256Sums(manifest: string, readBytes: ReadBytes, hashBytes: HashBytes): VerifyResult;
//# sourceMappingURL=sha256sums.d.ts.map