/**
 * Community WORKFLOW install (IT-5, spec D35/D23): download the published package, verify
 * size+checksum against registry metadata, gunzip, and parse the SANITIZED WorkflowBundle.
 *
 * Deliberately NOTHING lands on disk here: a workflow bundle is a declarative graph, not an
 * executable artifact — applying it goes through the same `workflow.import` write path every
 * other bundle uses (validateWorkflowDef gate, project-scoped persistence, credential re-bind
 * checklist in the UI). This function only fetches + verifies + parses.
 *
 * NOT the executable launcher-gate path: bundles carry no code; they run inside the engine's
 * restricted expression language under the D29/D30 permission gates, and applying one never
 * activates it (activation requires publish + the unattended grant door).
 */
import type { CommunityInstallResolution } from "../runtime/community/community-consent-client.js";
export interface CommunityWorkflowBundlePayload {
    kind: "workflow";
    mode: "bundle";
    resourceId: string;
    version: string;
    sourceTier: string;
    riskTier: string;
    /** The sanitized WorkflowBundle JSON (schemaVersion 2) — feed to workflow.import. */
    bundle: Record<string, unknown>;
    manifest: unknown;
}
export interface InstallCommunityWorkflowOptions {
    fetchFn?: typeof fetch;
}
export declare function installCommunityWorkflowResource(install: CommunityInstallResolution, options?: InstallCommunityWorkflowOptions): Promise<CommunityWorkflowBundlePayload>;
