/**
 * `telo release stage` — fetch, extract, verify and pin the files a module's
 * `sources:` block declares.
 *
 * Fetching is the CLI's alone: the kernel reads what this put on disk and never
 * reaches an upstream. Plain staging only verifies against the pins in the
 * manifest; `--pin` is the one writer of those pins, through the analyzer's
 * byte-splice editor, so nothing else in `telo.yaml` moves — and nothing is
 * written until the edited text reads back with exactly the pins computed.
 */
import { type SourceArchiveFormat } from "@telorun/analyzer";
import { type BundleEntry } from "@telorun/kernel";
export interface StageTarget {
    /** Workspace-relative module key, for messages. */
    readonly key: string;
    readonly dir: string;
    readonly manifestPath: string;
}
export interface StageOutcome {
    readonly module: string;
    readonly source: string;
    /** Module-relative path of the entry. */
    readonly path: string;
    readonly action: "verified" | "staged" | "linked" | "pinned";
}
export interface StageFailure {
    readonly module: string;
    readonly source?: string;
    readonly path?: string;
    readonly url?: string;
    readonly message: string;
}
export interface StageResult {
    readonly outcomes: StageOutcome[];
    readonly failures: StageFailure[];
}
/** Reads the archive at a URL, in the format its source declares, into its entries. */
export type ArchiveReader = (url: string, format: SourceArchiveFormat) => Promise<BundleEntry[]>;
/**
 * One fetch per URL for the life of the reader; the caller decides that life
 * (the command takes one reader per module, so decoded archives do not pile up
 * across a workspace). A request is bounded in time, in response size and in
 * decompressed size, and may not end at a URL a source could not name.
 */
export declare function createArchiveReader(options?: {
    fetchImpl?: typeof fetch;
    timeoutMs?: number;
    maxBytes?: number;
    maxExtractedBytes?: number;
}): ArchiveReader;
/**
 * Stage one module's `sources:`. With `pin`, fetch every file entry, write its
 * `sha256` and `executable` — and each built source's `build.inputs` — into the
 * manifest, then stage against those pins. A module with no `sources:` block
 * yields an empty result.
 */
export declare function stageModule(target: StageTarget, options: {
    pin: boolean;
    archives: ArchiveReader;
}): Promise<StageResult>;
//# sourceMappingURL=stage.d.ts.map