/**
 * HashManifest -- HMAC-signed file integrity manifests.
 *
 * Creates and verifies SHA-256 hash manifests for governance files.
 * Signs the manifest with HMAC-SHA256 to prevent tampering.
 * Used to detect unauthorized modifications to hooks, configs,
 * and compliance pack files.
 *
 * T-045: Sign hash manifests with HMAC.
 *
 * @connexum/ai-governance
 */
export interface HashManifestConfig {
    /** Directory to store manifests */
    manifestDir: string;
    /** HMAC signing secret */
    secret: string;
    /** Directories to scan for files */
    scanDirs: string[];
    /** File patterns to include (extensions) */
    includePatterns?: string[];
    /** File patterns to exclude */
    excludePatterns?: string[];
}
export interface ManifestEntry {
    file: string;
    sha256: string;
    sizeBytes: number;
    lastModified: string;
}
export interface Manifest {
    version: number;
    createdAt: string;
    entries: ManifestEntry[];
    signature: string;
}
export interface ManifestVerification {
    valid: boolean;
    signatureValid: boolean;
    totalFiles: number;
    changedFiles: string[];
    missingFiles: string[];
    newFiles: string[];
}
export declare class HashManifest {
    private config;
    private manifestFile;
    constructor(config: HashManifestConfig);
    /**
     * Generate a new signed manifest from the configured directories.
     */
    generate(): Manifest;
    /**
     * Verify the current files against the stored manifest.
     */
    verify(): ManifestVerification;
    /**
     * Get the stored manifest.
     */
    getManifest(): Manifest | null;
    /**
     * Get hash of a specific file from the manifest.
     */
    getFileHash(relativePath: string): string | undefined;
    private sign;
    private verifySignature;
    private resolveFile;
    private scanDir;
}
//# sourceMappingURL=hash-manifest.d.ts.map