export declare type GoSumHashes = Record<string, string>;
/**
 * Parse a go.sum file into a map of `<module>@<version>` -> its file-tree
 * (`h1:`) hash. go.sum records two lines per module version:
 *   <module> <version> h1:<base64>=          -> the module .zip hash (kept here)
 *   <module> <version>/go.mod h1:<base64>=   -> the go.mod hash (ignored)
 * We read the hash from go.sum rather than `go list` because `Module.Sum` is
 * only emitted by go >= 1.23, whereas the go.sum format is stable across all
 * supported go versions. See https://go.dev/ref/mod#go-sum-files
 */
export declare function parseGoSum(goSumContents: string): GoSumHashes;
/**
 * Build the component-metadata labels for a single Go module version. Produces:
 *   - `hash:sha-256`     the module's file-tree hash, decoded to lowercase hex
 *   - `distribution:url` the module proxy download URL for the .zip
 * `h1` is the module's `h1:` hash as recorded in go.sum. `goproxy` is the
 * effective GOPROXY value as reported by `go env GOPROXY` (see
 * buildDistributionUrl). Either label is omitted when it cannot be produced
 * (missing/invalid hash, or no proxy to derive a URL from).
 */
export declare function getComponentMetadataLabels(modulePath: string, version: string, h1: string | undefined, goproxy?: string): Record<string, string>;
/**
 * A go module `h1:` hash is the base64-encoded SHA-256 of the module's dirhash
 * manifest (see https://go.dev/ref/mod#go-sum-files). SBOM consumers expect a
 * lowercase hex digest, so decode base64 -> hex. Returns undefined when the
 * value is missing or not a well-formed 32-byte digest.
 */
export declare function decodeH1ToSha256Hex(h1?: string): string | undefined;
/**
 * Derive the module proxy download URL for a module version, e.g.
 * https://proxy.golang.org/github.com/!burnt!sushi/toml/@v/v1.2.3.zip
 * `goproxy` is the effective GOPROXY value as reported by `go env GOPROXY`
 * (which already applies env-var > go-env-file > built-in-default precedence).
 * Honours it when it points at an http(s) proxy; returns undefined for
 * `off`/`direct`/private setups where a public URL would be misleading.
 */
export declare function buildDistributionUrl(modulePath: string, version: string, goproxy?: string): string | undefined;
/**
 * Go escapes module paths and versions for case-insensitive filesystems by
 * replacing each uppercase letter with `!` followed by its lowercase form.
 * See https://go.dev/ref/mod#goproxy-protocol
 */
export declare function escapeModulePath(value: string): string;