/**
 * Public-config build-arg inference — the single source of truth for the
 * "public prefix" predicate and the helper that infers which public build-arg
 * keys a service implicitly declares.
 *
 * A build-arg key starting with a public prefix (`VITE_`, `NEXT_PUBLIC_`,
 * `PUBLIC_`) is world-readable by design: a bundler inlines its value into the
 * client bundle at build time. That is the EXPECTED use of `--build-arg`, and
 * it is the only mechanism by which `import.meta.env.VITE_*` values reach the
 * production client bundle (container ENV cannot reach the client).
 *
 * This module OWNS `PUBLIC_BUILD_ARG_PREFIXES` (the bake-guard imports it from
 * here, resolving the circular dependency the inference helper would otherwise
 * create). Phase 3 widens the build-arg key set in exactly one gated way: a
 * `.env`-FILE key or a declared service-environment key matching a public
 * prefix becomes a DECLARED build-arg. Raw shell env is never a key source.
 */
import type { DockerBuildArgValue } from "../manifest/schemas.js";
/**
 * Public-config prefixes. A `buildArgs` key starting with one of these is
 * world-readable by design (a bundler inlines it into the client bundle), so it
 * is the expected use of `--build-arg` and does not trip the bake-guard's
 * non-secret warning (R3). Single source of truth — consumed by the synth-time
 * guard, the pre-build guard, the bake-guard predicate, and the inference
 * helper below.
 */
export declare const PUBLIC_BUILD_ARG_PREFIXES: readonly ["VITE_", "NEXT_PUBLIC_", "PUBLIC_"];
/**
 * True iff `key` starts with one of the public build-arg prefixes
 * (`VITE_`, `NEXT_PUBLIC_`, `PUBLIC_`).
 */
export declare function isPublicBuildVarName(key: string): boolean;
export interface InferPublicBuildArgKeysInput {
    /**
     * The declared service environment (synth-time, source 1). Keys with a public
     * prefix here become declared build-args — they MUST bake even without a
     * `.env` file (the synth path write-through supplies the value).
     */
    declaredEnv?: Record<string, string>;
    /**
     * Parsed `.env`/`.env.<stage>` FILE keys (resolve-time, source 2). A public
     * prefix here promotes the key to a declared build-arg; the value is supplied
     * by the resolver's precedence ladder, not by this helper.
     */
    dotenvKeys?: readonly string[];
    /**
     * Already-explicit `docker.buildArgs`. A key present here is never inferred —
     * the explicit declaration always wins (and may carry an acknowledged
     * public-but-sensitive object form the inference must not clobber).
     */
    explicitBuildArgs?: Record<string, DockerBuildArgValue>;
}
/**
 * Infer the set of public-prefixed build-arg keys a service implicitly
 * declares, from its declared environment and its parsed `.env` file keys.
 *
 * Returns prefix-matched keys from `Object.keys(declaredEnv) ∪ dotenvKeys`,
 * MINUS any key already present in `explicitBuildArgs`, deduplicated. Pure — no
 * fs, no env reads; the caller supplies both sources.
 */
export declare function inferPublicBuildArgKeys(input: InferPublicBuildArgKeysInput): string[];