/**
 * Credential System Types
 *
 * Workspace-level credential store. Credentials (API keys, OAuth tokens) are
 * decoupled from skills: skills declare slots, users add named credentials,
 * agents bind specific credentials to slots at execution time.
 *
 * Registry entries are safe to show to LLM/agent contexts. Encrypted
 * payloads (containing real token values) are never exposed to the agent —
 * they are read only by the credential helper and by the skill executor
 * for env-var injection into subprocesses.
 *
 * @module types/credential.types
 */
/**
 * Thrown when a required slot has neither a binding nor a default.
 *
 * The error message now includes the list of available credentials of
 * the matching provider so the caller can re-invoke with the right
 * `credentialBindings` map without having to grep `~/.crewly/credentials/`
 * by hand. Issue #324.
 */
export class MissingCredentialError extends Error {
    slot;
    provider;
    available;
    constructor(slot, provider, available = []) {
        const base = `No credential bound to required slot '${slot}' (provider: ${provider}).`;
        const hint = available.length > 0
            ? ` Available ${provider} credentials: ${available
                .map((c) => `${c.id} (name="${c.name}", status=${c.status})`)
                .join(', ')}. Re-invoke with credentialBindings: { ${slot}: "<id>" }.`
            : ` No ${provider} credentials registered. Add one via the Settings → Credentials UI before invoking this skill.`;
        super(base + hint);
        this.slot = slot;
        this.provider = provider;
        this.available = available;
        this.name = 'MissingCredentialError';
    }
}
/**
 * Thrown when a bound credential's scopes do not cover the slot's requirements.
 */
export class InsufficientScopeError extends Error {
    slot;
    required;
    granted;
    missing;
    constructor(slot, required, granted) {
        const missing = required.filter((s) => !granted.includes(s));
        super(`Credential for slot '${slot}' is missing scope(s): ${missing.join(', ')}`);
        this.slot = slot;
        this.required = required;
        this.granted = granted;
        this.name = 'InsufficientScopeError';
        this.missing = missing;
    }
}
/**
 * Thrown when an OAuth credential's refresh token is no longer valid.
 * Carries the remediation string that callers (UI / agent) can surface to users.
 */
export class CredentialRevokedError extends Error {
    credentialId;
    credentialName;
    remediation;
    constructor(credentialId, credentialName, remediation) {
        super(`Credential '${credentialName}' (${credentialId}) is revoked. ${remediation}`);
        this.credentialId = credentialId;
        this.credentialName = credentialName;
        this.remediation = remediation;
        this.name = 'CredentialRevokedError';
    }
}
/**
 * Thrown when a referenced credential id doesn't exist in the registry.
 */
export class CredentialNotFoundError extends Error {
    credentialId;
    constructor(credentialId) {
        super(`Credential not found: ${credentialId}`);
        this.credentialId = credentialId;
        this.name = 'CredentialNotFoundError';
    }
}
//# sourceMappingURL=credential.types.js.map