import type { PlaceholderSpec, ReadOnlyWhitelistEntry } from './readonly-whitelist.js';
/** Upper bound on any single placeholder value, whatever its type. */
export declare const READONLY_VALUE_MAX_LENGTH = 200;
export type GuardRejection = {
    readonly ok: false;
    readonly param: string;
    readonly code: GuardRejectionCode;
    readonly message: string;
};
export type GuardRejectionCode = 'NOT_A_STRING' | 'EMPTY' | 'TOO_LONG' | 'FLAG_SHAPED' | 'CONTROL_CHARACTER' | 'WHITESPACE' | 'PATTERN_MISMATCH' | 'NOT_IN_ENUM' | 'NOT_AN_INTEGER' | 'OUT_OF_RANGE' | 'NOT_ABSOLUTE';
export type GuardResult = {
    readonly ok: true;
    readonly value: string;
} | GuardRejection;
/** The process options that keep the array from being re-parsed by a shell. */
export declare function readonlySpawnOptions(): {
    readonly shell: false;
};
/** Validate one placeholder value against its spec. */
export declare function validatePlaceholderValue(param: string, spec: PlaceholderSpec, raw: unknown): GuardResult;
export type BuildArgvResult = {
    readonly ok: true;
    readonly argv: string[];
} | GuardRejection;
/**
 * Render a whitelist entry into a concrete argv ARRAY.
 *
 * The output is never a string: literals and validated values are pushed as
 * separate elements, so no value can contribute token boundaries. A parameter the
 * entry does not declare is refused rather than appended.
 */
export declare function buildArgv(entry: ReadOnlyWhitelistEntry, values: Readonly<Record<string, string>>): BuildArgvResult;