/**
 * Detection and rendering helpers for the Vercel Deployment Protection
 * "Authentication Required" challenge that fronts protected previews and
 * production deployments.
 *
 * When the eve development client (`eve dev --url …`) targets a deployment
 * that has Deployment Protection enabled and no valid bypass header is
 * attached, Vercel returns an HTML SSO challenge instead of routing the
 * request to the function. The raw HTML body is unhelpful in a CLI
 * context — it dumps a multi-kilobyte page where a one-line directive
 * would do.
 *
 * These helpers let the REPL detect the challenge and render a focused,
 * actionable message instead.
 */
import type { DevelopmentOidcTokenFailure } from "#services/dev-client/request-headers.js";
/**
 * Returns `true` when the thrown error is the Vercel Deployment
 * Protection SSO challenge.
 *
 * Accepts both real {@link ClientError} instances and structurally
 * compatible duck-typed errors (`{ status: number, body: string }`)
 * so callers can detect the challenge regardless of whether the
 * error survived a network/IPC boundary.
 *
 * Exported so the dev REPL and other dev-client consumers can render
 * a focused authentication directive instead of dumping the SSO
 * challenge HTML to the terminal.
 */
export declare function isVercelAuthChallenge(error: unknown): boolean;
/**
 * Builds the human-readable message rendered when
 * {@link isVercelAuthChallenge} returns `true`.
 *
 * The message states the cause, the target URL, and the supported escape
 * hatches (link the project so an OIDC token can be minted, set an
 * automation bypass token, or disable protection). It is intentionally
 * short — multi-line CLI output is harder to scan than a focused
 * directive.
 */
export declare function formatVercelAuthChallengeMessage(input: {
    readonly serverUrl: string;
    readonly oidcTokenFailure?: DevelopmentOidcTokenFailure;
}): string;