import type { UrlMatcher, UrlMatcherType } from '../interfaces/Entry.mjs';
/** The most matchers a single entry may carry. */
export declare const MAX_MATCHERS_PER_ENTRY = 16;
/** The longest value any matcher may hold. */
export declare const MAX_MATCHER_VALUE_LENGTH = 512;
/**
 * The longest regex source a `Regex` matcher may hold.
 *
 * Catastrophic backtracking needs both a pathological pattern and a long
 * subject. Capping the pattern bounds the constant factor.
 */
export declare const MAX_REGEX_SOURCE_LENGTH = 200;
/**
 * Urls longer than this are not offered to `Regex` matchers.
 *
 * Backtracking blowup is superlinear in the length of the subject, so this is
 * the single highest-leverage limit. The cheaper matcher types still run.
 */
export declare const MAX_MATCHABLE_URL_LENGTH = 2048;
/** The longest `url` an entry may hold. */
export declare const MAX_URL_LENGTH = 2048;
/** The longest `inputSelector` an entry may hold. */
export declare const MAX_INPUT_SELECTOR_LENGTH = 256;
/**
 * Narrows an unknown value to a known matcher type.
 * @param value - The value to check.
 * @returns True when the value is one of `URL_MATCHER_TYPES`.
 */
export declare const isUrlMatcherType: (value: unknown) => value is UrlMatcherType;
/**
 * Compiles the source of a `Regex` matcher, refusing sources that are too long
 * or that look like they backtrack catastrophically.
 *
 * The pattern is anchored as `^(?:<source>)$`. This is the most
 * security-relevant decision in matching: an unanchored matcher of `github`
 * would fire on `https://evil.com/?q=github`. The non-capturing group also
 * stops a top-level alternation (`a|.*`) from escaping the anchors.
 *
 * The nested-quantifier check is a heuristic, not a decision procedure. It
 * catches the shapes people copy and paste; `(a|aa)+` still slips through.
 * Neither this check nor the length limits guarantee bounded execution time.
 * @param source - The regex source, as stored on the matcher.
 * @returns The compiled, anchored regex, or null when the source is refused.
 */
export declare const compileMatcherRegex: (source: string) => RegExp | null;
/**
 * Checks a single matcher.
 * @param matcher - The value to check, which may be anything at all.
 * @returns Null when the matcher is usable, otherwise the reason it is not.
 */
export declare const validateUrlMatcher: (matcher: unknown) => string | null;
/**
 * Parses the `TYPE:VALUE` spelling of a matcher, as used by the cli's
 * `--match` flag and by the `favaMatcher` otpauth parameter.
 *
 * Splits on the first colon only, so values containing colons (a `UrlPrefix`
 * of `https://example.com/login`, say) survive. The value is taken literally:
 * CLI arguments are already literal, and URI parameters are decoded once by
 * `URLSearchParams` before reaching this function.
 * @param spec - The spec to parse.
 * @returns The matcher, or null when the spec is unusable.
 */
export declare const parseMatcherSpec: (spec: string) => UrlMatcher | null;