/**
 * Whether an OAuth refresh failure is definitive (the credential must be
 * disabled) versus transient. Thin alias over the {@link Flag.OAuthExpiry}
 * text classifier {@link isOAuthExpiry}; retained as the public
 * `@oh-my-pi/pi-ai` entrypoint name used by the coding agent and auth-broker.
 */
export declare function isDefinitiveOAuthFailure(errorMsg: string): boolean;
/** Whether an upstream response explicitly says the supplied OAuth bearer was invalidated. */
export declare function isInvalidatedOAuthTokenError(error: unknown): boolean;
/**
 * Whether an upstream failure should retry through the credential resolver: a
 * typed token-refresh request, a hard `401`, a `403` (token valid but access
 * denied — plan, model policy, or org restriction a sibling account may not
 * share), an account-scoped policy denial such as Codex `cyber_policy`, a
 * body-classified usage limit (Codex `usage_limit_reached`, Anthropic account
 * rate-limit, Google `resource_exhausted`, OpenAI `insufficient_quota`, …), or
 * a bare `429` whose payload did not preserve a richer quota code. Transient
 * 429s (`Too many requests`, per-minute caps) stay in the upstream-backoff lane.
 */
export declare function isAuthRetryableError(error: unknown): boolean;