/**
 * The layers a payload build produces, before anything is framed: what may be
 * pushed, the index entry of a layer known by pins, and the entry rules a runtime
 * enforces at extraction, checked here first.
 */
import { type ArtifactSelector, type LayerRole } from "@telorun/analyzer";
import { type LayerEntry, type PayloadLayer } from "@telorun/kernel";
/** A layer built from a working copy: what publish pushes and what the release
 *  ledger digests. Mutable-shaped because the transport's own `PayloadLayer` is,
 *  and the two are handed straight across. */
export interface BuiltLayer {
    role: LayerRole;
    selector?: ArtifactSelector;
    /** A pinned entry appears only when the builder reads staged files from their
     *  pins, which publish never does. */
    files: LayerEntry[];
}
/** The layers a transport can push: every entry carries its bytes. Throws for a
 *  payload built from pins, which has none to push. */
export declare function pushableLayers(layers: readonly BuiltLayer[]): PayloadLayer[];
/**
 * The `blob` that stands in for a layer holding pinned entries, which has no
 * framed bytes to address: `sha256:` plus the hex form of the layer's integrity
 * digest — a digest over its pinned entries, deterministic across trees and
 * forks. It addresses nothing a registry holds, so only a digest of the manifest
 * that carries it may ever see it; publish frames the staged bytes instead.
 */
export declare function pinnedLayerBlob(files: readonly LayerEntry[]): Promise<string>;
/**
 * Refuse a payload with a layer extraction would refuse — a symbolic link that
 * does not name a file of its own layer, an entry path that is repeated or runs
 * through another entry — caught before anything is framed. A link to a
 * directory gets its own reason, since the link rule would call it dangling.
 */
export declare function assertLayerEntries(manifestDir: string, layers: readonly BuiltLayer[]): void;
//# sourceMappingURL=built-layers.d.ts.map