/**
 * Pointer-only install path.
 *
 * Given an {@link InstallManifest} (the Pointer Triple the Catalog hands
 * clients), this:
 *
 *   1. fetches the asset bytes directly from the upstream repo at the pinned
 *      commit (via an injectable fetcher, default {@link fetchAssetFilesFromGitHub});
 *   2. verifies EVERY per-file SHA256 against `manifest.files[].sha256`;
 *   3. verifies the composite SHA256 rollup over the sorted
 *      `<path>:<sha256>\n` lines against `manifest.sha256`;
 *   4. writes the verified bytes under `<libraryRoot>/@<publisher>/<name>/<version>`.
 *
 * Any hash mismatch is a hard failure — bytes are not written if per-file
 * verification fails, and the composite check is the second gate.
 *
 * @docLink packages/library/concepts#install
 */
import type { InstallManifest } from "@skaile/workspaces/types";
/**
 * Longest common **directory** prefix across manifest paths, compared by whole
 * slash-delimited segments (never raw-string — so `app/` and `app-data/` never
 * collide). Each path's basename is excluded, so the result is always a
 * directory prefix and every path keeps a non-empty remainder after stripping.
 *
 * Used by flat mode to reproduce the platform pointer-installer's asset-rooting:
 * the store persists repo-root-relative paths (e.g. `skaile-platform/mcpo/xls/MCP.md`)
 * but the runner scans `.skaile/assets/<kind>/<name>/` for immediate-child files,
 * so this prefix is stripped from the WRITE path while the fetch keeps the full
 * repo path. Returns `''` when there is no common directory (a no-op strip).
 */
export declare function longestCommonDirPrefix(paths: readonly string[]): string;
/**
 * Fetcher signature — fetches `{ path → Buffer }` for the requested paths at
 * a pinned upstream commit. {@link fetchAssetFilesFromGitHub} is the default
 * production implementation; tests inject a mock.
 */
export type AssetFetcher = (opts: {
    url: string;
    commitSha: string;
    paths: string[];
}) => Promise<Record<string, Buffer>>;
/**
 * Options for {@link installFromManifest}.
 */
export interface InstallOpts {
    /** The pointer-only install manifest from the Catalog. */
    manifest: InstallManifest;
    /** Filesystem root the asset is installed under (ref-derived mode). */
    libraryRoot: string;
    /**
     * Pluggable fetcher so tests can inject mock data. Defaults to
     * {@link fetchAssetFilesFromGitHub} in production.
     */
    fetcher?: AssetFetcher;
    /**
     * Flat-layout mode. When set, install-core reproduces the platform
     * pointer-installer's behavior: it ignores `libraryRoot`/ref-derivation, does
     * NOT parse `manifest.ref` and does NOT verify the composite sha256, strips
     * the longest-common-dir prefix from each path, per-file sha256-verifies, and
     * writes the stripped paths as immediate children of `targetDir` (what the
     * runner's `.skaile/assets/<kind>/<name>/` scan requires). `installPath` is
     * `targetDir`. Absent → unchanged ref-derived `@<pub>/name/version/<path>`
     * layout with composite verify.
     */
    targetDir?: string;
}
/**
 * Result of a successful {@link installFromManifest} call.
 */
export interface InstallResult {
    /** Absolute path the asset files were written to. */
    installPath: string;
}
/**
 * Fetch, verify, and write an asset's files per its {@link InstallManifest}.
 *
 * @throws An error matching `/hash mismatch/i` if any per-file SHA256 differs.
 * @throws An error matching `/composite hash mismatch/i` if the rollup differs.
 * @throws An error if the ref is malformed or the fetcher omits a file.
 */
export declare function installFromManifest(opts: InstallOpts): Promise<InstallResult>;
//# sourceMappingURL=install-from-manifest.d.ts.map