/**
 * AuthSec client-side errors — typed, actionable replacements for the raw
 * 401/403 a MCP transport hands back.
 *
 * The runtime SDK (server-side) emits structured JSON responses:
 *
 *   403: { error:"insufficient_scope", error_description, tool,
 *          required_scopes, granted_scopes }
 *   401: { error:"invalid_token", error_description, reason }
 *
 * On the agent side, transports like @modelcontextprotocol/sdk often flatten
 * those into a `ToolException`/`Error` whose `.message` is just the
 * `error_description`. This module gives operators a single helper —
 * `parseMcpError(thing)` — that accepts a Response, a parsed body, a raw
 * string, or an Error, and returns one of the typed subclasses below (or
 * `null` if the input doesn't look like an AuthSec denial).
 *
 * Example:
 *
 *     import { parseMcpError, TokenRevokedError } from '@authsec/sdk/client';
 *
 *     try {
 *       await client.callTool('slugify', {});
 *     } catch (e) {
 *       const accessErr = parseMcpError(e);
 *       if (accessErr) {
 *         console.error(accessErr.formatForUser());
 *         if (accessErr instanceof TokenRevokedError) reAuth();
 *         return;
 *       }
 *       throw e;
 *     }
 */
export type AuthSecReason = 'no_token' | 'invalid_token' | 'token_expired' | 'token_revoked' | 'client_registration_revoked' | 'audience_mismatch';
export interface AuthSecAccessErrorInit {
    description?: string;
    rawBody?: Record<string, unknown>;
    wwwAuthenticate?: string;
}
/** Base class for any AuthSec-side denial surfaced to the agent. */
export declare class AuthSecAccessError extends Error {
    readonly rawBody?: Record<string, unknown>;
    readonly wwwAuthenticate?: string;
    constructor(init?: AuthSecAccessErrorInit);
    formatForUser(): string;
}
export interface InsufficientScopeInit extends AuthSecAccessErrorInit {
    tool?: string;
    requiredScopes?: string[];
    grantedScopes?: string[];
}
/** The token is valid but lacks a scope the tool requires. */
export declare class InsufficientScopeError extends AuthSecAccessError {
    readonly tool?: string;
    readonly requiredScopes: string[];
    readonly grantedScopes: string[];
    constructor(init?: InsufficientScopeInit);
    formatForUser(): string;
}
/** The bearer token was revoked. Agent should clear cached tokens & re-auth. */
export declare class TokenRevokedError extends AuthSecAccessError {
    formatForUser(): string;
}
/** The OAuth client registration itself was revoked. Re-auth won't help. */
export declare class ClientRegistrationRevokedError extends AuthSecAccessError {
    formatForUser(): string;
}
export interface AuthRequiredInit extends AuthSecAccessErrorInit {
    reason?: AuthSecReason;
}
/** No token / invalid / expired / wrong audience. Agent should re-auth. */
export declare class AuthRequiredError extends AuthSecAccessError {
    readonly reason: AuthSecReason;
    constructor(init?: AuthRequiredInit);
    formatForUser(): string;
}
/** Parse whatever the MCP transport handed you into a typed
 *  `AuthSecAccessError`, or `null` if it doesn't look like an AuthSec denial. */
export declare function parseMcpError(source: unknown): Promise<AuthSecAccessError | null>;
//# sourceMappingURL=errors.d.ts.map