import { Readable } from "stream";
/**
 * v0.7 — manifest.tsv builder for farewell archives.
 * Per docs/plan/v0.7-uninstall-lifecycle.md §6.2 + §10 #3.
 *
 * Each row records one archive entry — its path inside the zip, SHA256
 * digest (or null for masked credentials), size, class, and notes. The
 * SHA256 is computed *while* the archive is being written (streaming) so
 * we never re-open the finished zip.
 */
export interface ManifestRow {
    /** Path inside the archive zip (forward slashes). */
    path: string;
    /** SHA256 hex digest, or `null` for entries with no hash (masked credentials). */
    sha256: string | null;
    /** Bytes, or `null` for synthetic entries. */
    size: number | null;
    /** Asset class string ("A*", "B", "C", "D", etc.). */
    cls: string;
    /** Free-form note (e.g. "wal-safe-backup", "values redacted"). */
    notes?: string;
}
export declare class ManifestBuilder {
    private readonly rows;
    add(row: ManifestRow): void;
    size(): number;
    rowsView(): readonly ManifestRow[];
    /** Render as TSV text per §6.2. */
    toTsv(): string;
}
declare function escapeTsv(s: string): string;
/**
 * Compute SHA256 of a Buffer. Synchronous — use for small payloads
 * (archive.yaml, env.template, REVOKE-CHECKLIST.md, etc.).
 */
export declare function sha256OfBuffer(buf: Buffer): string;
/**
 * Compute SHA256 of a Readable stream. Used for large files that we don't
 * want to load into memory (workflows transcripts, archive.sqlite). The
 * stream is consumed.
 */
export declare function sha256OfStream(stream: Readable): Promise<string>;
/**
 * A Transform-like helper that tees a stream into a hash while letting the
 * data flow through. Used by the archive writer so we can hash and zip in
 * one pass.
 */
export interface HashTap {
    /** Update with the chunk that just passed through. */
    update(chunk: Buffer | string): void;
    /** Finalize and return the hex digest. */
    digest(): string;
}
export declare function createHashTap(): HashTap;
/**
 * Wrap a Readable into a pass-through that also hashes. Caller piped both
 * the result and the hash callback into an archive writer.
 *
 * Implementation note: archiver lib reads the stream directly, so the
 * cleanest way is to attach a `data` listener that taps the hash without
 * altering the stream's data path.
 */
export declare function tapStream(src: Readable, tap: HashTap): Readable;
/** Re-export for convenience in tests. */
export declare const _internal: {
    escapeTsv: typeof escapeTsv;
};
export {};