/**
 * Login detection — pure, dependency-light helpers shared by the opcode runner
 * (to classify a failure as login-related) and credential substitution
 * (opcode-actions.ts owns the actual `{{token}}` replacement).
 *
 * A program "logs in" when it types credentials: a TYPE opcode whose text (or a
 * locale override) contains the `{{email}}` / `{{password}}` placeholder. The
 * server resolves these placeholders at capture time from the preset's linked
 * credentials account; the stored program only ever holds the placeholders.
 *
 * This module imports ONLY types so it stays safe to reference from any layer.
 */
import type { ExecutionOpcode } from './execution-types.js';
/** The credential placeholder tokens — the contract between the authored
 *  program and the server-side substitution. Single source of truth. */
export declare const CREDENTIAL_TOKEN_EMAIL = "{{email}}";
export declare const CREDENTIAL_TOKEN_PASSWORD = "{{password}}";
export declare const CREDENTIAL_TOKEN_LOGIN_URL = "{{loginUrl}}";
/**
 * Which credential fields the program actually requires. Lets a caller compare
 * against the linked account's available fields (has_email / has_password)
 * without decrypting anything.
 */
export declare function programRequiredCredentialFields(steps: ExecutionOpcode[]): {
    email: boolean;
    password: boolean;
};
/** True when the program logs in (types an email or password). */
export declare function programRequiresLogin(steps: ExecutionOpcode[]): boolean;
/**
 * The contiguous index range that constitutes the login flow:
 * - `start` = first credential-typing opcode,
 * - `end`   = first post-login assertion after the last credential opcode —
 *             EITHER a standalone assertion opcode (ASSERT_ROUTE /
 *             ASSERT_SURFACE / WAIT_FOR) OR, as the generator actually emits,
 *             the submit CLICK whose own postcondition asserts the post-login
 *             route/element (route_matches / element_visible) — else the last
 *             credential opcode itself.
 *
 * Scanning stops at that FIRST asserting opcode, so the window covers the
 * credential typing and the submit (which proves login) but does NOT extend
 * across the post-login navigation. A failure anywhere in `[start, end]` means
 * the login did not go through: a TYPE failing (form gone/changed), the submit
 * failing, or its post-login assertion failing (still on /login). Returns null
 * when the program does not log in.
 */
export declare function getLoginWindow(steps: ExecutionOpcode[]): {
    start: number;
    end: number;
} | null;
/** True when a failure at `failedIndex` falls inside the login window. */
export declare function isLoginFailureIndex(steps: ExecutionOpcode[], failedIndex: number): boolean;