/**
 * Build-related implementations for `DockerCli`.
 *
 * `_buildxBuild` validates the args via `BuildxBuildArgsSchema.safeParse()`
 * (Pitfall 4 — never `.parse()` inside a `Result`-returning function),
 * spawns `docker buildx build` with the argv from the pure builder,
 * line-buffers `--progress=rawjson` stdout into the rawjson parser, fires
 * `onProgress` events through the masking boundary, then reads the
 * `--metadata-file` for `containerimage.digest` to assemble the
 * `BuildxBuildResult`.
 *
 * Resource discipline (per AC12 + robustness-standards § "Resource
 * Acquisition Inside `try`"): the `--metadata-file` path is treated as a
 * caller-owned-but-DockerCli-cleaned resource. `let
 * tempMetadataPathForCleanup: string | undefined` outside the `try`,
 * captured inside, removed via `rm(..., { force: true }).catch(...)` in
 * `finally`. The `force: true` flag also short-circuits a missing-file
 * cleanup which is the common case for failed-build paths where buildx
 * never wrote the file.
 */
import { type BuildxBuildArgs, type BuildxBuildResult, type DockerCliError } from "./dockerCliSchemas.js";
import { type BuildxProgressEvent, type DockerCliState, type ImagetoolsInspect, type Result } from "./DockerCli.js";
export declare function _buildxBuild(state: DockerCliState, args: BuildxBuildArgs, onProgress: (event: BuildxProgressEvent) => void, abortSignal?: AbortSignal): Promise<Result<BuildxBuildResult, DockerCliError>>;
/**
 * Create one or more tags pointing at an existing image digest without
 * re-uploading layers.
 *
 * Implementation: `docker buildx imagetools create --prefer-index=false
 * --tag <tag1> --tag <tag2> ... <sourceImage>@<digest>`. The source
 * `image@digest` reference pins the immutable content; each `--tag`
 * argument creates (or moves) a mutable name pointing at that digest. The
 * registry stores no new blobs, only a new manifest reference per tag.
 *
 * `--prefer-index=false` is required: `imagetools create` defaults to
 * wrapping even a SINGLE source manifest in a new image index (a "fat
 * manifest") rather than carbon-copying it, on the assumption that its
 * caller might be assembling a multi-arch tag from several
 * platform-specific sources. fjall never does that — every call here
 * re-tags exactly one already-built (single-platform) digest — so the
 * index wrapper is pure overhead, and worse: AWS Lambda's
 * CreateFunction/UpdateFunctionCode rejects an image index outright, so a
 * Lambda pulling by this tag would fail even though the digest-addressed
 * push (buildAndPush) produced a flat manifest. `--prefer-index=false`
 * makes `imagetools create` copy the source manifest byte-for-byte under
 * the new tag instead.
 *
 * Discipline:
 *   - argv-only spawn (`shell: false` via `runDocker`)
 *   - tag values are validated to be non-empty strings before they enter argv
 *   - stderr is masked and bounded by `makeError(... stderrTail)`
 *   - timeout: `DEFAULT_REGISTRY_MANIFEST_TIMEOUT_MS`. This is a REGISTRY
 *     WRITE — an auth exchange plus one manifest PUT per tag — so it must not
 *     borrow the local-daemon inspect budget, which it did until 2026-07-24.
 */
export declare function _tagByDigest(state: DockerCliState, sourceImage: string, digest: string, tags: readonly string[]): Promise<Result<void, DockerCliError>>;
export declare function _imagetoolsInspect(state: DockerCliState, image: string): Promise<Result<ImagetoolsInspect, DockerCliError>>;