/**
 * Auth error handling utilities for app shells.
 *
 * Provides reusable functions for detecting auth errors, refreshing tokens,
 * and redirecting to login when sessions expire.
 *
 * @module @burdenoff/fe-libs/shared/utils/authErrorHandling
 */
/**
 * Clear all auth-related session storage for the active profile.
 * Used when a session expires or the user logs out.
 *
 * @param clearAuthStore - Optional callback to clear external auth stores (e.g., zustand)
 */
export declare function clearAuthSessionStorage(clearAuthStore?: () => void): void;
/**
 * Check if a network error is an authentication error (session expired/invalid).
 *
 * IMPORTANT: Only 401/UNAUTHENTICATED errors trigger login redirect.
 * 403/FORBIDDEN errors are authorization errors (user is logged in but lacks permission)
 * and should NOT redirect to login — the UI should show "Access Denied" instead.
 */
export declare function isAuthNetworkError(error: Error): boolean;
export interface GraphQLErrorLike {
    message?: string | null;
    extensions?: Record<string, unknown> | null;
}
/**
 * Check if a GraphQL error represents an expired or otherwise invalid session.
 *
 * IMPORTANT: Like network auth detection, this intentionally avoids treating
 * generic FORBIDDEN/403 authorization failures as login-expiry events.
 */
export declare function isAuthGraphQLError(error: GraphQLErrorLike): boolean;
/**
 * Check a GraphQL error array for any expired/invalid-session error.
 */
export declare function hasAuthGraphQLErrors(errors: readonly GraphQLErrorLike[] | null | undefined): boolean;
export interface TokenRefreshConfig {
    /** Base URL of the global gateway */
    globalBaseUrl: string;
    /** Whether a refresh is currently in progress (for deduplication) */
    isRefreshing: {
        current: boolean;
    };
    /** Promise of the in-flight refresh (for deduplication) */
    refreshPromise: {
        current: Promise<void> | null;
    };
}
/**
 * The shared single-flight dedup refs for {@link attemptTokenRefresh}. Use
 * these (rather than per-caller refs) so concurrent 401s from different code
 * paths coalesce into one refresh mutation.
 */
export declare function getSharedTokenRefreshRefs(): Pick<TokenRefreshConfig, 'isRefreshing' | 'refreshPromise'>;
/**
 * Attempt to refresh the access token using the stored refresh token.
 * Returns true if refresh succeeded, false if it failed.
 * Uses refs for deduplication so concurrent 401 errors trigger only one refresh.
 */
export declare function attemptTokenRefresh(config: TokenRefreshConfig): Promise<boolean>;
/**
 * Redirect to login page after session expiry.
 * Captures the current URL as returnTo for post-login redirect.
 *
 * @param clearAuthStore - Optional callback to clear external auth stores
 * @param loginPath - Override the login path (default: /auth/login)
 */
export declare function redirectToLogin(clearAuthStore?: () => void, loginPath?: string): void;
//# sourceMappingURL=authErrorHandling.d.ts.map