import { type H3Event } from "h3";
/**
 * Why a presented bearer token was refused. `invalid` covers every token
 * nothing here could verify. The others describe a credential this app issued
 * and verified, so its holder has proven possession and can act on the reason.
 */
export type BearerCredentialRefusal = "invalid" | "revoked" | "unknown-connect-token" | "identity-mismatch" | "not-member" | "email-retired" | "service-principal-inactive";
/**
 * One sentence naming the refusal. It travels in a `WWW-Authenticate`
 * `error_description`, so it must stay printable ASCII without `"` or `\`.
 */
export declare function describeBearerCredentialRefusal(refusal: BearerCredentialRefusal): string;
export declare function describeBearerCredentialRefusalWithRecovery(refusal: BearerCredentialRefusal, connectUrl: string | undefined): string;
/**
 * Records why this request's bearer token was refused, so the auth guard's
 * 401 says why instead of a bare `Unauthorized`.
 */
export declare function markBearerCredentialRefused(event: H3Event, refusal: BearerCredentialRefusal, connectUrl: string | undefined): void;
export declare function respondBearerCredentialRefused(event: H3Event): {
    error: string;
    reason: BearerCredentialRefusal;
    message: string;
} | null;