export interface SafeSandboxErrorCause {
    name?: string;
    message?: string;
    code?: string | number;
    status?: string | number;
    phase?: string;
    endpoint?: string;
    origin?: string;
    retryAfterMs?: number;
    sidecarVersion?: string;
    containerImage?: string;
}
export interface SafeSandboxErrorDiagnostics {
    message: string;
    causes: SafeSandboxErrorCause[];
    truncated: boolean;
    truncatedAtDepth?: number;
    cycle: boolean;
}
export declare function serializeSandboxProvisioningError(error: unknown, options?: {
    maxDepth?: number;
}): SafeSandboxErrorDiagnostics;
export declare function formatSandboxProvisioningSupportDetails(diagnostics: SafeSandboxErrorDiagnostics): string;
export declare function isSandboxAuthFailure(diagnostics: SafeSandboxErrorDiagnostics): boolean;
export declare function isSandboxApiBearerAuthFailure(diagnostics: SafeSandboxErrorDiagnostics): boolean;
/**
 * True when the sandbox API answered 404 for a specific sandbox resource — the
 * box behind a persisted sandbox id no longer exists.
 *
 * A sandbox id is a cache of where a workspace's box lives, not the workspace's
 * identity: the platform reaps, suspends, and loses boxes as ordinary lifecycle
 * events. Callers use this to discard the dead id and provision a replacement,
 * so the match is deliberately narrow — a 404 from the runtime sidecar
 * (`/runtime/...`, a missing file or session inside a live box) is NOT this.
 */
export declare function isSandboxApiSandboxMissingFailure(diagnostics: SafeSandboxErrorDiagnostics): boolean;
/**
 * True when a resume failed because the host the box is pinned to cannot seat
 * it — the host's slot budget is exhausted, not the box's fault and not
 * something waiting fixes.
 *
 * A box lives on one host. When that host fills, every future resume for every
 * box on it fails identically and permanently, so a workspace whose box landed
 * on a full host is bricked until it is placed somewhere else. Callers use this
 * the same way they use {@link isSandboxApiSandboxMissingFailure}: discard the
 * dead id and provision a replacement, which the orchestrator is free to place
 * on a host with room. The workspace itself is preserved — it lives in the
 * Vault, not in the box's filesystem.
 *
 * Matched on the message because the sandbox API returns a generic
 * `SERVER_ERROR` for it; a dedicated code upstream would replace this.
 */
export declare function isSandboxHostCapacityFailure(diagnostics: SafeSandboxErrorDiagnostics): boolean;
/**
 * True when a resume failed on the box's own configuration rather than on
 * anything a retry can change.
 *
 * These are permanent facts about one box: the platform cannot rebuild its
 * proxy because the egress policy it was created with is no longer recorded, so
 * the box can never start again where it is. The platform says as much in the
 * message — "re-apply the sandbox egress policy and retry" is a description of
 * creating a fresh box, since policy is applied at creation.
 *
 * Narrow on purpose. A bare 500 from the sandbox API is transient far more
 * often than not, and treating one as unbringable would delete a healthy box.
 * Matched on the specific unrecoverable phrasing, and only from `sandbox-api`.
 */
export declare function isSandboxBoxConfigFailure(diagnostics: SafeSandboxErrorDiagnostics): boolean;
export declare function formatSandboxProvisioningUserMessage(diagnostics: SafeSandboxErrorDiagnostics): string;