/**
 * FROZEN profile catalog — mirrored from `e2b-template/dev-sandbox/gen-dockerfile.sh` `profile_bands()`.
 * (db / browser-nodriver are opt-in overlays, NOT in `code-full` — `code-full-db` adds db; per design §4.)
 */
export declare const FROZEN_PROFILES: readonly string[];
/** FROZEN band set — mirrored from the `e2b-template/dev-sandbox/bands/` directory (one dir per band). */
export declare const FROZEN_BANDS: readonly string[];
/**
 * FROZEN bump-tool set — the toolchain identifiers a `--bump <tool>=<ver>` may target. Conservative union of the
 * version-overridable toolchains the bands accept (`<TOOL>_VERSION` env, build.sh forwards `--bump tool=ver`).
 * Set-membership is the gate; the value is range-checked by VER_RE. Off-list tool → 400 (never coerced).
 */
export declare const FROZEN_BUMP_TOOLS: readonly string[];
/** Bump value range (P2.4d): printable version-ish tokens only, ≤40 chars — folds into the lockhash. */
export declare const VER_RE: RegExp;
/** Belt-only band shape (set-membership is the real gate); a defense-in-depth reject of structurally weird ids. */
export declare const BAND_SHAPE_RE: RegExp;
/** The raw, untrusted submit body fields this module validates (operator free-text). */
export interface BakeSubmit {
    profile?: unknown;
    bands?: unknown;
    baseRef?: unknown;
    bump?: unknown;
    push?: unknown;
    dryRun?: unknown;
    logs?: unknown;
    /** RFC B4: bake-time package-source profile — "cn" (default) | "global". Closed set, never coerced. */
    pkgSource?: unknown;
}
/** A validation rejection: the HTTP status + a stable error envelope (matches the live images-block shape). */
export interface BakeReject {
    ok: false;
    status: number;
    error: string;
    /** P2.14 #2 — structured band-conflict for the composer UI; null otherwise. */
    conflictBands?: string[];
}
/** A vetted bake: the normalized inputs + the RAW argv vector the runner array-spawns (and only this). */
export interface BakeAccept {
    ok: true;
    profile: string;
    bands: string[] | null;
    baseRef: string | null;
    bump: Record<string, string> | null;
    push: boolean;
    dryRun: boolean;
    logs: boolean;
    /** RFC B4: vetted bake-time package-source profile; null = build.sh default (cn). */
    pkgSource: "cn" | "global" | null;
    /** The VETTED build.sh argv (NOT including `build.sh` itself) — raw vetted vector, array-spawned (no shell). */
    argv: string[];
}
export type BakeValidation = BakeAccept | BakeReject;
/**
 * Validate + normalize a `POST /v1/images/bakes` body into a vetted argv, or a typed rejection.
 *
 * Order is deliberate: profile XOR bands → bands set-membership (dupes/empties/shape) → bump set+range →
 * baseRef shape (the index allow-list check is done by the caller via `baseRefAllowed`, async) → build the
 * raw vetted argv. The output repo is server-fixed (`sema-images/<profile>`); the caller CANNOT set
 * `--tag` (build.sh auto-computes the immutable tag — kills namespace-squat) nor an arbitrary `FROM`.
 *
 * `baseRefAllowed` is checked HERE for shape only; the digest-in-index allow-list is the caller's async step
 * (it owns the TiDB index). A present-but-malformed `baseRef` is rejected before any DB hit.
 */
export declare function validateBake(body: BakeSubmit): BakeValidation;
/**
 * Build the VETTED, NORMALIZED build.sh argv from an accepted validation + the caller-resolved effective fields
 * (the index-checked baseRef and the build-host CACHE_BASE — both runner-environment facts image-api injects,
 * never operator free-text). The elements are RAW (no shell-quoting): the runner array-spawns build.sh so each
 * element lands in its own argv slot (no shell can re-interpret a frozen-set value). The runner runs
 * `build.sh <argv...>` and ONLY this.
 *
 * Server-fixed invariants enforced here (NOT caller-settable, P2.4d):
 *   - `--json` always (machine output the runner parses).
 *   - selection is `--profile <p>` XOR `--bands a,b,c` (already vetted).
 *   - NO `--tag` (build.sh auto-computes the immutable tag — kills namespace-squat / overwrite-by-naming).
 *   - the output repo is server-fixed `sema-images/<profile>` (build.sh's IMAGE_PREFIX default; not forwarded).
 *   - `--base-ref` is the index-checked effective base (caller resolves the default when absent).
 *   - `--cache-base` is the build-host promoted cache (runner env).
 */
export declare function buildBakeArgv(v: BakeAccept, effective: {
    baseRef: string | null;
    cacheBase: string | null;
}): string[];
//# sourceMappingURL=bake-validate.d.ts.map