/**
 * Shared MCP error classes, error wrapping, and bridge-error discrimination.
 *
 * Consolidates the `instanceof`-chains and remediation-message patterns found
 * in `client.ts` / `auth.ts` across the fleet. Every error carries an optional
 * `hint` — a "here's how to fix it" string the tool surface can show the user.
 *
 * The fetchproxy typed-error hierarchy (`Fetchproxy*Error`) is re-exported, not
 * reimplemented; {@link classifyBridgeError} is a thin discriminator over it.
 */
/** Default seconds to wait before retrying a tripped bot-wall (issue #90 tuning). */
export declare const DEFAULT_BOT_WALL_RETRY_AFTER_S = 30;
/** Default truncation budget for upstream error bodies surfaced to clients. */
export declare const DEFAULT_ERROR_MESSAGE_MAX = 500;
/**
 * Base class for every tool-facing error. Carries an optional `hint` —
 * actionable remediation text ("set ZOLA_REFRESH_TOKEN", "sign in at compass.com")
 * the tool surface can present separately from the message.
 */
export declare class McpToolError extends Error {
    /** Actionable remediation text, when one applies. */
    readonly hint?: string;
    constructor(message: string, opts?: {
        hint?: string;
        cause?: unknown;
    });
}
/**
 * The user's browser session isn't signed in to the upstream service. Distinct
 * from a transient bot-wall — this is a stable "go authenticate" condition.
 */
export declare class SessionNotAuthenticatedError extends McpToolError {
    constructor(service?: string, signInHost?: string);
}
/**
 * Transient anti-bot interstitial (PerimeterX / DataDome CAPTCHA). The request
 * was rate-limited, NOT a missing resource — back off and retry. Kept distinct
 * from {@link SessionNotAuthenticatedError} so callers don't misclassify a
 * retryable wall as a stale session (issue #90).
 */
export declare class BotWallError extends McpToolError {
    /** Suggested seconds to wait before retrying the blocked request(s). */
    readonly retryAfterSeconds: number;
    /** The wall vendor when the classifier identified one (e.g. `'DataDome'`, `'Cloudflare'`). */
    readonly vendor?: string;
    constructor(path: string, retryAfterSeconds?: number, opts?: {
        vendor?: string;
    });
}
/** Upstream returned HTTP 429 (or an equivalent rate-limit signal). */
export declare class RateLimitError extends McpToolError {
    /** Seconds the upstream asked us to wait, when it told us. */
    readonly retryAfterSeconds?: number;
    constructor(service: string, retryAfterSeconds?: number);
}
/** Upstream is unreachable (5xx / transport failure) — not the caller's fault. */
export declare class UnreachableError extends McpToolError {
    /** Upstream HTTP status, when one was observed. */
    readonly status?: number;
    constructor(service: string, status?: number);
}
/**
 * A tool requires a different auth/operation mode than the server is running in
 * (e.g. a Pro key-mode-only report invoked while in session mode).
 */
export declare class ModeMismatchError extends McpToolError {
    readonly currentMode: string;
    readonly requiredMode: string;
    readonly feature: string;
    constructor(currentMode: string, requiredMode: string, feature: string);
}
/** Factory for an {@link McpToolError} with a remediation hint. */
export declare function createHelpfulError(message: string, opts?: {
    hint?: string;
}): McpToolError;
/**
 * Redact secrets that commonly leak into upstream error bodies before the text
 * is surfaced to a client: `Bearer <token>` / `Authorization: Basic <…>` headers,
 * `Cookie:` / `Set-Cookie:` header values (cookie names stay visible), standalone
 * JWTs, well-known API-key shapes (OpenAI/Anthropic `sk-…`, GitHub `ghp_…`,
 * Slack `xox?-…`, Google `AIza…`, AWS `AKIA…`, `whsec_…`), secret-bearing
 * URL query params (`access_token`, `api_key`, `token`, `key`, `sig`, …), and
 * quote-wrapped JSON secret values (`"refresh_token":"…"` in an OAuth/error
 * body — the key must be an exact secret name, so `"token_type":"Bearer"` and
 * other non-secret keys stay visible).
 *
 * Exported so fleet repos can redact custom strings (log lines, debug payloads)
 * without taking on {@link truncateErrorMessage}'s length cap.
 */
export declare function redactSecrets(text: string): string;
/**
 * Redact secrets, then cap an (upstream) error string at `max` characters,
 * appending a `… [truncated]` marker when clipped.
 *
 * Security: redaction runs BEFORE truncation so a token straddling the cut
 * boundary can't survive in a half-form. Untrusted upstream bodies must always
 * go through this before reaching a tool result.
 */
export declare function truncateErrorMessage(text: string, max?: number): string;
/** Extract a string message from any thrown value. */
export declare function messageOf(err: unknown): string;
/**
 * Prepend the tool name to an error's context and return an {@link McpToolError},
 * preserving any `hint` and chaining the original via `cause`. The message is
 * run through {@link truncateErrorMessage} (redaction + truncation). Re-wrapping
 * an already-prefixed error does not double-prefix.
 */
export declare function wrapToolError(toolName: string, err: unknown): McpToolError;
/** Options for {@link maskSecret}. */
export interface MaskSecretOptions {
    /** Leading characters kept visible. Defaults to 8. */
    head?: number;
    /** Trailing characters kept visible. Defaults to 4. */
    tail?: number;
}
/**
 * Mask a credential for display in a confirmation message: keep the first
 * `head` and last `tail` characters with an ellipsis between
 * (`abcdefgh…wxyz`). A value too short to mask safely (≤ `head + tail` chars)
 * is fully hidden as `…` — a partial reveal of a short secret would leak most
 * of it.
 *
 * Consolidates onehome's `fingerprint()` — for `<svc>_set_session`-style tools
 * that echo back WHICH credential they stored without echoing the credential.
 */
export declare function maskSecret(value: string, opts?: MaskSecretOptions): string;
//# sourceMappingURL=index.d.ts.map