import type { VercelCredentials } from './auth.js';
import { type VercelImagePin } from './image.js';
/**
 * Resolve which Sandbox image to boot.
 *
 * The rule is: tags for development, digests for releases. Nothing in the
 * source tree carries a digest, so a commit's code and its image always come
 * from the same commit. A published package carries a frozen pin emitted at
 * publish time; a git checkout resolves a channel tag instead.
 */
/** The channel a git checkout follows when no release pin is present. */
export declare const VERCEL_IMAGE_CHANNEL = "nightly";
/** Repository the channel tag is resolved against. */
export declare const VERCEL_IMAGE_REPOSITORY = "vcr.vercel.com/astro-labs/devbox/devbox";
export type VercelImageSource = 'override' | 'release-pin' | 'channel';
export interface VercelImageResolution {
    /** Fully-qualified `<host>/<team>/<project>/<repository>@sha256:<digest>`. */
    reference: string;
    source: VercelImageSource;
}
/**
 * Resolves a channel tag to a manifest digest. Injected so the transport stays
 * out of the precedence logic and so tests never reach the network.
 */
export type VercelImageChannelResolver = (channel: string, credentials: VercelCredentials, signal?: AbortSignal) => Promise<string>;
export interface VercelImageResolutionOptions {
    env: NodeJS.ProcessEnv;
    credentials: VercelCredentials;
    resolveChannel: VercelImageChannelResolver;
    /** Overridable for tests; defaults to the emitted package pin. */
    releasePinUrl?: URL;
    signal?: AbortSignal;
}
export declare class VercelImageResolutionError extends Error {
    readonly code = "image_resolution_failed";
    constructor(message: string);
}
/**
 * Read the frozen pin emitted into a published package. Returns undefined in a
 * git checkout, where no pin file is emitted.
 */
export declare function readReleasePin(pinUrl?: URL): VercelImagePin | undefined;
export declare function resolveVercelImage(options: VercelImageResolutionOptions): Promise<VercelImageResolution>;