/**
 * Minimal shape extracted from an api invoke-time `auth_required` (HTTP 202)
 * response. The approval URL is NOT carried here — the 202 body has none; the
 * ExecutionEngine mints one via `createApprovalRequest` after detecting this
 * signal. `action` is surfaced for the error message; the wire's
 * `determining_policy_ids` is intentionally NOT carried — the agentd audit
 * sink has no attribution field for it today (same gap as the forbid branch),
 * so parsing it would imply coverage that doesn't exist.
 */
export interface ApiApprovalRequired {
    action?: string;
}
/**
 * Probe an api response body for an invoke-time `auth_required` signal.
 *
 * The api shape (HTTP 202, produced by GlobalHttpExceptionFilter's passthrough
 * for AuthRequiredException) is TOP-LEVEL — NOT the `metadata.action` envelope
 * that reauth uses:
 *   `{ statusCode: 202, code: 'auth_required', decision: 'auth_required',
 *      action, determining_policy_ids }`
 *
 * So we key off `code`/`decision` at the top level (either may be present).
 * Returns the extracted payload if present, otherwise `undefined`.
 *
 * Note: a Cedar `policy_forbidden` (403) is a DIFFERENT, terminal signal and is
 * intentionally not matched here — it arrives on the non-2xx path and is
 * classified separately by the gateway-client.
 */
export declare function extractApprovalRequired(body: unknown): ApiApprovalRequired | undefined;
/** Check if an error message indicates an invalid credential (expired, revoked, etc.) */
export declare function isCredentialInvalidError(message?: string): boolean;
/**
 * Minimal shape of the reauth payload api returns on revoked/expired OAuth tokens.
 * Kept loose on purpose — the api may add fields without breaking agentd.
 *
 * Layer note — three similar types intentionally exist in this repo:
 *   - `ApiReauthRequired` (this file): wire shape parsed from api bodies
 *   - `ReauthRequiredInfo`     (gateway-client.ts): wire-level result carried
 *     alongside `InvokeToolResult.errorCode`
 *   - `ReauthRequiredExecutionInfo` (core/types.ts): user-facing ExecuteResult
 *     field, trimmed of wire-level knobs (e.g. `metadata`)
 * The duplication is deliberate: each layer drops context the next one
 * doesn't need, which keeps the CLI surface minimal.
 */
export interface ApiReauthRequired {
    provider: string;
    reason: string;
    message: string;
    authUrl: string;
    projectId?: string;
    metadata?: Record<string, any>;
}
/**
 * Probe an api response body for a reauth_required signal.
 *
 * The api shape is:
 *   `{ success:false, error, metadata: { action: 'reauth_required',
 *      reauthRequired: { provider, reason, message, authUrl, projectId, ... } } }`
 *
 * Returns the extracted payload if present, otherwise `undefined`.
 *
 * Guards:
 *   - Requires `authUrl` to be a non-empty string (without it the signal is
 *     useless — the CLI caller has nothing to surface to the user).
 *   - Does not trust the outer `success` flag. If a future api bug sets
 *     `success:true` on a reauth response, we still treat it as a reauth
 *     failure: the underlying SaaS token is gone, and any "data" in that
 *     envelope would be stale or misleading. `action:'reauth_required'`
 *     is the canonical signal, not `success`. (Spec'd in gateway-client
 *     reauth tests as the "contradictory body" regression guard.)
 */
export declare function extractReauthRequired(body: unknown): ApiReauthRequired | undefined;
//# sourceMappingURL=credential-errors.d.ts.map