/**
 * Collecting what the planner needs: one `ModuleEvidence` per module.
 *
 * Three separate readings, because the plan asks three separate questions:
 *
 * - **The payload digest** — built through the shared `ModulePayloadBuilder`, so
 *   the number recorded here is the number `telo publish` computes against the
 *   registry. That equality is the whole point of the ledger.
 * - **The edge graph** — from the build's own metafile (which module's source
 *   got inlined into whose artifact) and from in-repo relative `imports:`. A
 *   declared-dependency graph cannot see `--external`, so `@telorun/sdk` —
 *   declared by 54 modules, inlined by none — would bump the entire standard
 *   library on every SDK change.
 * - **Own changed files** — a git diff, path-scoped. It used to decide the
 *   version, which is why its guesswork had to be sound; here it decides only
 *   whether a changelog line is requested.
 */
import { type LayerDigests, type ModuleEvidence } from "@telorun/analyzer";
import { type ModulePayload } from "../bundle/module-payload.js";
import type { DiscoveredModule, Workspace } from "./workspace.js";
export interface EvidenceOptions {
    /** `oci://host/org` — the base each module's destination derives from. */
    readonly registry: string;
    /** Git ref the changed-files reading diffs against. */
    readonly baseRef: string;
    /** Called before each module is built, so a long batch shows progress. */
    readonly onModule?: (module: DiscoveredModule, index: number, total: number) => void;
}
/**
 * A module's publish destination: the registry base plus its own directory name.
 *
 * Identity is the ref, never `metadata.name` — this is the same rule the release
 * job has always applied, lifted out of a shell script.
 *
 * This is the ROOT destination, which is a policy rather than a derivation:
 * nothing in the graph can say which repo a module publishes to. The payload
 * builder derives a SIBLING's from it instead of re-applying this rule, so the
 * ref an artifact carries and the destination its dependency is pushed to are
 * the same string by construction.
 */
export declare function destinationFor(registry: string, module: DiscoveredModule): string;
/**
 * A built payload reduced to the per-layer digest map the ledger records.
 *
 * ONE function, because there are two write paths into the ledger — `apply`
 * recording what it is about to publish, and `verify --write` re-recording what
 * the registry actually serves — and the gates only work if they produce the
 * same map. Two hand-built copies that drifted would make `verify --write`
 * record numbers `check` cannot reproduce, and every module would then report
 * permanent phantom drift: the exact failure the ledger's "both gates compute
 * the same number" premise rests on not happening.
 */
export declare function digestPayload(payload: ModulePayload): Promise<LayerDigests>;
export declare function collectEvidence(workspace: Workspace, options: EvidenceOptions): Promise<ModuleEvidence[]>;
export declare function imageDigest(module: DiscoveredModule): Promise<string>;
//# sourceMappingURL=evidence.d.ts.map