/**
 * Plan 3b — Phase 3.5 (security audit): centralized AST parse-time safety.
 *
 * Adapters consume oversized / pathological user source. Tree-sitter is
 * fast but synchronous — there is no native timeout, no native size cap.
 * This module provides:
 *
 *   1. `MAX_AST_FILE_BYTES` — 1MB hard cap per file (covers DoS vector
 *      "oversized file"). Plan §1 cited 5MB; we apply a tighter bound at
 *      the adapter tier because adapter sample size is small (≤3 files
 *      per adapter) and 1MB is already an order of magnitude beyond
 *      reasonable convention-defining files.
 *   2. `MAX_AST_PARSE_DEPTH` — 5K-deep nested-structure rejection — a
 *      static text scan for runaway open-paren / open-brace runs that
 *      would push Tree-sitter into deep recursion. Cheap pre-check.
 *   3. `parseTimeout(ms, fn)` — wraps a synchronous Tree-sitter call in
 *      a deadline guard. Tree-sitter's pure-JS path can't be interrupted
 *      mid-parse, but we record the elapsed time AFTER the call returns
 *      and emit a stderr warning when budget is exceeded so daemon ops
 *      see the abuse signal.
 *   4. `isParsableSource(source)` — static gate combining size + depth.
 *      Returns `null` if accepted, or a `{ reason, detail }` object when
 *      rejected so the adapter can record provenance and skip the file.
 *
 * Library purity: never terminates the process, no DB calls, no network.
 * Pure helper module.
 */
/** Hard size cap for an individual file fed to Tree-sitter. */
export declare const MAX_AST_FILE_BYTES: number;
/**
 * Maximum nested-bracket depth allowed in a file. Pathological inputs
 * with 10K-deep nesting can push Tree-sitter into runaway recursion on
 * some grammar versions. Cheap O(n) text scan picks them off before parse.
 */
export declare const MAX_AST_PARSE_DEPTH = 5000;
/**
 * Per-file Tree-sitter parse budget (ms). Tree-sitter parses are
 * synchronous in JS, so this is enforced as a post-call elapsed-time
 * check rather than a hard timer. The check still serves the purpose of
 * giving operators visibility into adversarial files.
 */
export declare const MAX_AST_PARSE_MS = 2000;
export type ParseSkipReason = 'size-cap' | 'depth-cap' | 'control-bytes' | 'utf8-validation';
export interface ParseSkip {
    reason: ParseSkipReason;
    detail: string;
}
/**
 * Static safety gate. Call BEFORE invoking `parser.parse()`. Returns
 * `null` if the source is acceptable, or a `ParseSkip` describing why
 * the file is rejected.
 *
 * Cheap to evaluate — single linear scan + size check.
 */
export declare function isParsableSource(source: string, sizeBytes?: number): ParseSkip | null;
/**
 * Wrap a synchronous Tree-sitter call and emit a warning when the call
 * exceeds the budget. Returns the call's result regardless — callers may
 * decide to discard it based on `elapsed`.
 *
 * Note: Tree-sitter's WASM path has no co-operative cancellation, so
 * this is observability rather than a hard kill. The size + depth caps
 * are the load-bearing mitigations; this is the third belt.
 */
export declare function withParseDeadline<T>(fn: () => T, filePath: string, budgetMs?: number): {
    value: T;
    elapsedMs: number;
    overBudget: boolean;
};
