export type RawHttpRequestDump = {
    provider: string;
    api: string;
    model: string;
    method?: string;
    url?: string;
    headers?: Record<string, string>;
    body?: unknown;
};
export type CapturedHttpErrorResponse = {
    status: number;
    headers?: Headers;
    bodyText?: string;
    bodyJson?: unknown;
};
/**
 * Build the JSON persisted for a rejected request. Request fields stay at the
 * top level (so existing dump parsers still read `body`); the provider's error
 * is added under `errorResponse` so a failed request is diagnosable from the
 * dump file rather than the request alone.
 */
export declare function buildHttp400DumpPayload(dump: RawHttpRequestDump, error: unknown, message: string): RawHttpRequestDump & {
    errorResponse: {
        status: number | undefined;
        message: string;
    };
};
/** HTTP statuses whose rejected request we persist for post-hoc diagnosis: the
 *  request-content rejections that wedge a session. 400 (bad request) and 413
 *  (payload too large — an oversized image / snapcompact frame payload that 413s
 *  and empties the turn). Auth (401/403), not-found (404), rate limits and 5xx
 *  are excluded: 429/5xx are retried, so persisting them here would write one
 *  dump per attempt. */
export declare function shouldDumpRejectedRequest(error: unknown): boolean;
/**
 * Remove the local request-dump lines {@link appendRawHttpRequestDumpFor400} appends,
 * leaving only the provider-facing error text. Hosts that relay provider errors
 * (RPC `prompt_result`) must not leak OMP-local file paths.
 */
export declare function stripRawHttpRequestDiagnostics(message: string): string;
export declare function appendRawHttpRequestDumpFor400(message: string, error: unknown, dump: RawHttpRequestDump | undefined): Promise<string>;
export interface HttpRequestDumpRetention {
    /** Dump file name never deleted (the one just written and referenced by the error). */
    keep?: string;
    /** Dumps last modified longer ago than this are deleted (default 7 days). */
    maxAgeMs?: number;
    /** Oldest remaining dumps are deleted until the directory totals at most this (default 64 MiB). */
    maxTotalBytes?: number;
    now?: number;
}
/**
 * Bound the rejected-request dump directory: delete `*.json` dumps older than
 * the age limit, then the oldest survivors until the total fits the size cap.
 */
export declare function pruneHttpRequestDumps(dir: string, retention?: HttpRequestDumpRetention): Promise<void>;
export declare function finalizeErrorMessage(error: unknown, rawRequestDump: RawHttpRequestDump | undefined, capturedErrorResponse?: CapturedHttpErrorResponse): Promise<string>;
/**
 * Rewrite error message for GitHub Copilot request failures.
 * Must run AFTER finalizeErrorMessage since it replaces the message entirely.
 *
 * 401 = token invalid/expired → credential removal is safe, prompt re-login.
 * 403 = token valid but access denied (plan, model policy, org restriction) →
 *       do NOT reuse the auth-failed string (which triggers credential removal).
 * 400 is left verbatim: GitHub's body names the cause (`model_not_supported`,
 *       `model_not_available_for_integrator` with its `Available models` list)
 *       and a rewrite only hides it.
 */
export declare function rewriteCopilotError(errorMessage: string, error: unknown, provider: string): string;
/**
 * Rewrite error messages for ClinePass request failures. Gated to the
 * cline-pass provider: the "model not found" marker is too generic to match
 * for other hosts.
 *
 * not-subscribed (400) = the key is valid but the account has no ClinePass
 *        subscription; free-tier models remain usable on the same key.
 * org restriction (400) = organization accounts cannot use individual
 *        inference subscriptions; a personal-account key is required.
 * model-not-found (400) = roster rotation removed the model since selection;
 *        the fix is reselection, not retry. (Quota windows — "clinepass
 *        limit", "free limit reached on model" — are classified upstream in
 *        error/rate-limit and need no rewrite.)
 * surface-gate (403) = the model is restricted to Cline's official clients.
 *        Requests carry the mirrored CLI identity headers, so reaching this
 *        means Cline's gate policy changed; the classifier exempts it from
 *        credential rotation (sibling keys fail identically).
 */
export declare function rewriteClinePassError(errorMessage: string, provider: string): string;