/**
 * Failure construction for the `DockerCli` implementation files.
 *
 * Two things every docker failure needs and none of them used to get:
 *
 *  1. The stderr tail reaching a sink. Every failure branch already builds one
 *     and, until these helpers existed, every consumer read only `.message` —
 *     docker's own words were constructed, masked, and dropped.
 *     `makeLoggedError` mirrors the tail to the debug log at the point of
 *     failure so `~/.fjall/logs/` carries it into a support bundle.
 *  2. An honest abort verdict. Docker traps SIGTERM and exits 130 well inside
 *     the SIGKILL grace, so an `exitCode === null` test alone misses the
 *     ordinary abort and the run falls through to "failed (exit 130)".
 *
 * Masking: `makeError` masks each tail line and only then bounds it
 * (mask-before-truncate), so the tail is never re-masked here. It does NOT
 * mask `message`, and `spawnFailureToError` folds an error body into one — so
 * the debug payload masks it at that boundary. The consumer path is a separate
 * output path with its own single mask in `describeDockerFailure`.
 */
import type { DockerCliError, DockerCliErrorKind } from "./dockerCliSchemas.js";
import { type DockerCliState } from "./DockerCli.js";
/** The slice of a `runDocker`/`streamDocker` result these helpers read. */
export interface DockerRunOutcome {
    readonly exitCode: number | null;
    readonly aborted: boolean;
    readonly timedOut: boolean;
    readonly stderrTail: readonly string[];
}
export declare function makeLoggedError(state: DockerCliState, kind: DockerCliErrorKind, message: string, details?: Record<string, unknown>): DockerCliError;
export declare function spawnFailureToError(state: DockerCliState, result: {
    spawnError?: string;
    stderrTail: readonly string[];
}): DockerCliError;
/**
 * A run ended via the composed abort signal. `exitCode === null` means the
 * child died to a signal it did not trap (a bare SIGTERM, or the SIGKILL
 * escalation after the grace); the ordinary path is docker trapping SIGTERM
 * and exiting 130 on its own, which is why `aborted` has to be consulted.
 */
export declare function wasAborted(result: {
    aborted: boolean;
    exitCode: number | null;
}): boolean;
/**
 * A per-call budget expiry and a caller cancel fire the same composed signal,
 * so `timedOut` is the only discriminator — without it a real timeout reports
 * as `kind: "abort"`, which reads as "the user pressed ctrl-c".
 */
export declare function abortOrTimeoutError(state: DockerCliState, result: DockerRunOutcome, operation: string, timeoutMs: number): DockerCliError;