export declare const WORKSPACE_APP_ACCESS_UNAVAILABLE: "unavailable";
export declare const WORKSPACE_APP_ACCESS_UNAVAILABLE_MESSAGE = "Workspace app access is temporarily unavailable.";
export type WorkspaceAppAccessUnavailableReason = "directory-url-invalid" | "org-domain-lookup-failed" | "org-a2a-secret-lookup-failed" | "org-domain-missing" | "a2a-secret-missing" | "token-signing-failed" | "registry-timeout" | "registry-fetch-failed" | "registry-http-error" | "registry-malformed-response" | "claim-http-error" | "claim-malformed-response";
/**
 * The access check could not reach a verdict. Distinct from `false`: the
 * caller is not refused, the answer is unknown, and `reason` says which step
 * failed so a 503 can be traced without server logs.
 */
export interface WorkspaceAppAccessUnavailable {
    status: typeof WORKSPACE_APP_ACCESS_UNAVAILABLE;
    reason: WorkspaceAppAccessUnavailableReason;
    /** HTTP status of the Dispatch registry reply, when one arrived. */
    upstreamStatus?: number;
    /** Audience the caller signed for: origin and path only, never userinfo. */
    audience?: string;
    /** Short text from the upstream reply or error class. Untrusted. */
    detail?: string;
}
/** What `isWorkspaceAppAccessAllowed` has always returned. */
export type WorkspaceAppAccessOutcome = boolean | typeof WORKSPACE_APP_ACCESS_UNAVAILABLE;
/** A verdict, or the cause when none could be reached. */
export type WorkspaceAppAccessCheck = boolean | WorkspaceAppAccessUnavailable;
export declare function isWorkspaceAppAccessUnavailable(outcome: unknown): outcome is WorkspaceAppAccessUnavailable;
export declare function workspaceAppAccessUnavailable(reason: WorkspaceAppAccessUnavailableReason, extra?: Pick<WorkspaceAppAccessUnavailable, "upstreamStatus" | "audience" | "detail">): WorkspaceAppAccessUnavailable;
export declare function workspaceAppAccessUnavailableBody(outcome: WorkspaceAppAccessUnavailable): {
    error: string;
    code: WorkspaceAppAccessUnavailableReason;
    upstreamStatus?: number;
    audience?: string;
    detail?: string;
};
/**
 * Names a thrown error without echoing its message: driver and upstream
 * messages can carry hostnames or connection strings.
 */
export declare function describeFetchFailure(error: unknown): {
    timedOut: boolean;
    detail: string;
};
/**
 * Reads the human-readable refusal out of a registry error reply, if it sent
 * JSON. A non-JSON or unreadable body yields no detail; the HTTP status on the
 * outcome already says the call failed.
 */
export declare function registryErrorDetail(body: unknown): string | undefined;