/**
 * The promoted Vercel image contract.
 *
 * A release consumes a public, fully-qualified VCR reference pinned by
 * manifest digest. The candidate workflow records the reviewed open-source
 * Universal recipe provenance before it opens the promotion PR; release
 * validation rejects incomplete or untested pins.
 */
declare const VCR_HOST = "vcr.vercel.com";
export interface VercelImageReference {
    registry: typeof VCR_HOST;
    team: string;
    project: string;
    repository: string;
    digest: string;
}
export interface VercelImageScope {
    team: string;
    project: string;
}
export interface VercelImageProvenance {
    schemaVersion: 1;
    platform: 'linux/amd64';
    upstream: {
        repository: string;
        commit: string;
        ubuntuDockerfileSha256: string;
        universalDockerfileSha256: string;
    };
    observedManagedVmi: {
        digest: string;
        versions: Record<string, string>;
    };
    baseImages: {
        ubuntu: string;
        bun: string;
    };
    node: {
        version: string;
        platform: 'linux-x64';
        sha256: string;
    };
    chromium: {
        version: string;
        platform: 'linux64';
        url: string;
        sha256: string;
    };
    aptSnapshot: string;
    runtimePackages: Record<string, string>;
}
export interface VercelImagePin {
    /** The only image reference consumed by the Vercel provider. */
    reference: string;
    /** The reviewed open-source Universal recipe and all pinned inputs. */
    provenance: VercelImageProvenance;
    /** SHA-256 of the exact checked-in provenance artifact. */
    provenanceDigest: string;
    /** The devbox repository commit that produced the candidate. */
    sourceCommit: string;
    publisherSmokeUrl: string;
    consumerSmokeUrl: string;
    publisher: VercelImageScope;
    consumer: VercelImageScope;
    /** The exact reference passed to both Sandbox smoke gates. */
    testedReference: string;
    publisherSmokeStatus?: 'passed' | 'failed' | 'pending';
    consumerSmokeStatus?: 'passed' | 'failed' | 'pending';
    crossProjectVerified?: boolean;
}
export interface VercelImagePinValidation {
    ok: boolean;
    reference?: VercelImageReference;
    errors: string[];
}
/** Compare an SDK-returned repository@digest image to the promoted manifest digest. */
export declare function matchesVercelSandboxImageDigest(image: unknown, expectedDigest: string): boolean;
/**
 * Parse a fully-qualified VCR image reference.
 *
 * Tags, bare project-relative names, and references from another registry are
 * intentionally not accepted here. The thrown error is useful to callers
 * that need a strict parser; use validateVercelImagePin for user-facing lists
 * of errors.
 */
export declare function parseVercelImageReference(value: string): VercelImageReference;
/**
 * Validate the release-facing image pin and all evidence needed to promote it.
 * This is deliberately pure so package-quality checks and workflow scripts can
 * exercise the same rules without credentials or a live Vercel project.
 */
export declare function validateVercelImagePin(pin: VercelImagePin): VercelImagePinValidation;
/** Throw a compact error when a release pin is not promotable. */
export declare function assertValidVercelImagePin(pin: VercelImagePin): VercelImageReference;
/**
 * The exact audited mirror inputs from images/vercel/provenance.json. Loaded
 * from the checked-in artifact (like release validation does) so the refresh
 * workflow's provenance bump cannot leave this contract stale.
 */
export declare const VERCEL_IMAGE_PROVENANCE: VercelImageProvenance;
export {};