/**
 * Wall detection: pure classification of harness output against the
 * descriptor's limit and auth matchers. Returns the CODE, never the matched
 * line - the consumers of a detection are a retained record and a viewer
 * warning, and anything the harness printed on that line (a prompt, a
 * filename, a customer's name) must not ride along (v1 D-005: records carry
 * identifiers and outcomes, never content).
 *
 * Feed these wall-eligible output only - stderr and the non-JSON tail of a
 * dying turn - never assistant message content, where the model merely
 * TALKING about limits would match.
 *
 * Matchers are serializable objects {pattern, flags, code/kind}; compilation
 * to RegExp happens here with bounded inputs (pattern length, count, flags)
 * and a WeakMap cache. The input window (first 4096 chars of a line), not
 * pattern analysis, is the backtracking bound - a malicious pattern could
 * otherwise catastrophically backtrack on a long line.
 */
import type { AuthFailureKind, AuthMatcher, HarnessDescriptor, LimitCode, LimitMatcher } from "../knowledge/descriptor.js";
export declare const compileLimitMatchers: (matchers: ReadonlyArray<LimitMatcher>) => ReadonlyArray<readonly [RegExp, LimitCode]>;
export declare const compileAuthMatchers: (matchers: ReadonlyArray<AuthMatcher>) => ReadonlyArray<readonly [RegExp, AuthFailureKind]>;
/** Per-line entry point for streaming readers: O(1) per line, no rescans.
 * Both runners feed lines as they arrive; there is no batch form. */
export declare const detectLimitInLine: (h: HarnessDescriptor, line: string) => LimitCode | null;
export declare const detectAuthFailureInLine: (h: HarnessDescriptor, line: string) => AuthFailureKind | null;
/** A network or gateway fault between the harness and its provider. */
export declare const detectTransportInLine: (line: string) => boolean;
/** A provider that answered but cannot serve the requested model. */
export declare const detectUnavailableInLine: (line: string) => boolean;
/** A workspace-trust gate refusal (cursor): compiled under the same
 * matcher bounds as every other wall, so a crafted override cannot widen
 * it. Harnesses without trustMatchers never detect. */
export declare const detectTrustRefusal: (h: HarnessDescriptor, line: string) => boolean;
/** A reset time stated in a limit wall's prose. */
export type ResetHint = {
    readonly kind: "local-datetime";
    /** Calendar fields as printed (month 1-12, day 1-31, hour 0-23). */
    readonly year: number;
    readonly month: number;
    readonly day: number;
    readonly hour: number;
    readonly minute: number;
} | {
    readonly kind: "local-time";
    readonly hour: number;
    readonly minute: number;
} | {
    readonly kind: "relative";
    readonly minutes: number;
};
/** The reset time a limit wall states in its prose, if any. Codex prints
 * an absolute local timestamp (minute precision, no zone); pi prints
 * relative minutes. Everything else - `try again later`, a limit message
 * with no time stated - yields null; a reset is never guessed. */
export declare const resetHintInLine: (line: string) => ResetHint | null;
/** Epoch ms for a hint. `now` is epoch ms; `utcOffsetMinutes(epochMs)` is
 * the local zone's offset east of UTC at that instant (+420 for +07:00).
 * Returns null when a local form cannot be resolved. A relative hint is
 * the upper bound of pi's rounded minutes (+30 s); a printed timestamp is
 * minute-truncated, so the wall resolves to the END of that minute - the
 * reset has certainly happened by then, never earlier. */
export declare const resolveResetHint: (hint: ResetHint, now: number, utcOffsetMinutes: ((epochMs: number) => number) | undefined) => number | null;
//# sourceMappingURL=limits.d.ts.map