/**
 * Evidence collection core module.
 * Collects forensic data from a server via a single batched SSH connection.
 * Writes per-file evidence to a flat directory with SHA256 checksums.
 */
import type { KastellResult } from "../types/index.js";
export interface EvidenceFileEntry {
    filename: string;
    sha256: string;
    sizeBytes: number;
    collectedAt: string;
    status: "collected" | "skipped";
    skipReason?: string;
}
export interface EvidenceManifest {
    schemaVersion: 1;
    server: string;
    ip: string;
    platform: string;
    collectedAt: string;
    evidenceDir: string;
    files: EvidenceFileEntry[];
}
export interface EvidenceResult {
    evidenceDir: string;
    serverName: string;
    serverIp: string;
    platform: string;
    collectedAt: string;
    totalFiles: number;
    skippedFiles: number;
    manifestPath: string;
}
export interface EvidenceOptions {
    name?: string;
    output?: string;
    lines: number;
    noDocker: boolean;
    noSysinfo: boolean;
    force: boolean;
    json: boolean;
    quiet: boolean;
}
/**
 * Collect forensic evidence from a server via a single batched SSH connection.
 * Writes per-file evidence to a flat directory with SHA256 checksums.
 */
export declare function collectEvidence(serverName: string, ip: string, platform: string, opts: EvidenceOptions): Promise<KastellResult<EvidenceResult>>;
//# sourceMappingURL=evidence.d.ts.map