import { BASE_ERROR_INSTANCE, BaseError, ErrorOptions, INSTANCEOF_PROPERTY, hasInstanceof, markInstanceof, matchesInstanceof, serializeInstanceofChain } from "@ebec/core";
//#region src/types.d.ts
export type AuthupErrorOptions = ErrorOptions & {
  data?: Record<string, any>;
};
export type AuthupErrorInput = string | AuthupErrorOptions;
export type AuthupEntityErrorOptions = AuthupErrorOptions & {
  entity?: string;
};
export type AuthupEntityErrorInput = string | AuthupEntityErrorOptions;
//#endregion
//#region src/module.d.ts
export declare const AUTHUP_ERROR_INSTANCE: unique symbol;
export declare class AuthupError extends BaseError {
  readonly data?: Record<string, any>;
  constructor(input?: AuthupErrorInput);
  /**
   * `super.toJSON()` already emits the serialized marker chain, but the
   * `data` spread runs after it — re-stamped last so a `data` key cannot
   * displace the genuine chain.
   */
  toJSON(): {
    "@instanceof": string[];
    name: string;
    message: string;
    code: string;
    cause?: unknown;
    errors?: unknown[];
    issues?: readonly import("@ebec/core").Issue[];
  };
}
//#endregion
//#region src/built-in/unauthorized.d.ts
export declare const UNAUTHORIZED_ERROR_INSTANCE: unique symbol;
export declare class UnauthorizedError extends AuthupError {
  constructor(input?: string | AuthupErrorOptions);
}
//#endregion
//#region src/built-in/auth-header.d.ts
export declare const AUTH_HEADER_ERROR_INSTANCE: unique symbol;
export declare class AuthHeaderError extends UnauthorizedError {
  constructor(message: string);
  static unsupportedType(type: string): AuthHeaderError;
}
//#endregion
//#region src/built-in/bad-request.d.ts
export declare const BAD_REQUEST_ERROR_INSTANCE: unique symbol;
export declare class BadRequestError extends AuthupError {
  constructor(input?: string | AuthupErrorOptions);
}
//#endregion
//#region src/built-in/bearer-token.d.ts
export declare const BEARER_TOKEN_MALFORMED_ERROR_INSTANCE: unique symbol;
export declare class BearerTokenMalformedError extends UnauthorizedError {
  constructor(message?: string);
}
//#endregion
//#region src/built-in/validation.d.ts
export declare const VALIDATION_ERROR_INSTANCE: unique symbol;
/**
 * A domain/business-rule violation raised by core logic. Deliberately NOT
 * named after an HTTP status: core code stays transport-agnostic, and the HTTP
 * adapter maps its `ErrorCode.BAD_REQUEST` to a 400 response
 * (`httpStatusFromCode`). Prefer this over `BadRequestError` in `core/**`.
 */
export declare class ValidationError extends AuthupError {
  constructor(input?: string | AuthupErrorOptions);
}
//#endregion
//#region src/built-in/device-verification-throttled.d.ts
export declare const DEVICE_VERIFICATION_THROTTLED_ERROR_INSTANCE: unique symbol;
export type DeviceVerificationThrottledErrorOptions = AuthupErrorOptions & {
  /**
   * Seconds until the per-actor lookup window releases the account.
   */
  retryAfter?: number;
};
export declare class DeviceVerificationThrottledError extends AuthupError {
  constructor(input?: DeviceVerificationThrottledErrorOptions);
}
//#endregion
//#region src/built-in/entity-conflict.d.ts
export declare const ENTITY_CONFLICT_ERROR_INSTANCE: unique symbol;
export declare class EntityConflictError extends AuthupError {
  constructor(input?: string | AuthupEntityErrorOptions);
}
//#endregion
//#region src/built-in/entity-credentials-invalid.d.ts
export declare const ENTITY_CREDENTIALS_INVALID_ERROR_INSTANCE: unique symbol;
export declare class EntityCredentialsInvalidError extends AuthupError {
  constructor(input?: string | AuthupEntityErrorOptions);
}
//#endregion
//#region src/built-in/entity-inactive.d.ts
export declare const ENTITY_INACTIVE_ERROR_INSTANCE: unique symbol;
export declare class EntityInactiveError extends AuthupError {
  constructor(input?: string | AuthupEntityErrorOptions);
}
//#endregion
//#region src/built-in/entity-not-found.d.ts
export declare const ENTITY_NOT_FOUND_ERROR_INSTANCE: unique symbol;
export declare class EntityNotFoundError extends AuthupError {
  constructor(input?: string | AuthupEntityErrorOptions);
}
//#endregion
//#region src/built-in/internal.d.ts
export declare const INTERNAL_ERROR_INSTANCE: unique symbol;
export declare class InternalError extends AuthupError {
  constructor(input?: string | AuthupErrorOptions);
}
//#endregion
//#region src/built-in/login-throttled.d.ts
export declare const LOGIN_THROTTLED_ERROR_INSTANCE: unique symbol;
export type LoginThrottledErrorOptions = AuthupErrorOptions & {
  /**
   * Seconds until the sliding throttle window can release the pair.
   */
  retryAfter?: number;
};
export declare class LoginThrottledError extends AuthupError {
  constructor(input?: LoginThrottledErrorOptions);
}
//#endregion
//#region src/built-in/mfa-throttled.d.ts
export declare const MFA_THROTTLED_ERROR_INSTANCE: unique symbol;
export type MfaThrottledErrorOptions = AuthupErrorOptions & {
  /**
   * Seconds until the exponential backoff releases the account.
   */
  retryAfter?: number;
};
export declare class MfaThrottledError extends AuthupError {
  constructor(input?: MfaThrottledErrorOptions);
}
//#endregion
//#region src/built-in/check.d.ts
export declare function isAuthHeaderError(input: unknown): input is AuthHeaderError;
export declare function isBearerTokenMalformedError(input: unknown): input is BearerTokenMalformedError;
export declare function isBadRequestError(input: unknown): input is BadRequestError;
export declare function isValidationError(input: unknown): input is ValidationError;
export declare function isUnauthorizedError(input: unknown): input is UnauthorizedError;
export declare function isEntityNotFoundError(input: unknown): input is EntityNotFoundError;
export declare function isEntityConflictError(input: unknown): input is EntityConflictError;
export declare function isEntityInactiveError(input: unknown): input is EntityInactiveError;
export declare function isEntityCredentialsInvalidError(input: unknown): input is EntityCredentialsInvalidError;
export declare function isInternalError(input: unknown): input is InternalError;
export declare function isLoginThrottledError(input: unknown): input is LoginThrottledError;
export declare function isMfaThrottledError(input: unknown): input is MfaThrottledError;
export declare function isDeviceVerificationThrottledError(input: unknown): input is DeviceVerificationThrottledError;
//#endregion
//#region src/check.d.ts
/**
 * Duck-type guard for `Error`.
 *
 * Re-exports `@ebec/core`'s shape-based check: `input` matches when it
 * carries the standard `name` / `message` / `stack` triplet, regardless
 * of which realm or class hierarchy produced it. Use this instead of
 * `instanceof Error` for cross-realm boundaries (worker threads,
 * duplicate-module copies) where `instanceof` can yield false negatives.
 */
export declare function isError(input: unknown): input is Error;
/**
 * Duck-type guard for AuthupError.
 *
 * The chain decides, and only the chain: it matches when the AuthupError
 * marker is in it, as the native symbol (in-process) or its serialized
 * string form (JSON-rehydrated). Subclass instances accumulate this
 * marker, so any AuthupError subclass (`OAuth2Error`, `JWTError`, ...)
 * matches too, while a foreign `@ebec/core` error (rapiq's ParseError,
 * which since 2.2 also carries an `issues` array) does not: it announced
 * its ancestry and AuthupError is not in it.
 *
 * Chain-less input never matches. A shape-based fallback for pre-chain
 * JSON (`BaseError` + `issues: Issue[]`) used to cover that case, but
 * `@ebec/core`'s `isBaseError` became chain-only, so that fallback could
 * never fire — and now that every `BaseError` carries an `issues` array,
 * the shape it checked for would no longer distinguish an AuthupError
 * from any other ebec-derived error anyway. There is no reliable way left
 * to recognise a chain-less legacy payload as specifically an AuthupError.
 */
export declare function isAuthupError(input: unknown): input is AuthupError;
//#endregion
//#region src/constants.d.ts
export declare enum ErrorCode {
  BAD_REQUEST = "bad_request",
  INTERNAL_ERROR = "internal_error",
  /**
   * An outbound call to a service this server depends on failed, either
   * as a transport failure or as an error answer. Distinct from
   * INTERNAL_ERROR so a caller can tell "authup is broken" from "authup
   * could not reach a dependency", and so the upstream status is never
   * mirrored onto authup's own response.
   */
  UPSTREAM_ERROR = "upstream_error",
  HTTP_HEADER_AUTH_TYPE_UNSUPPORTED = "unsupported_auth_header_type",
  HTTP_BEARER_TOKEN_MALFORMED = "bearer_token_malformed",
  IDENTITY_UNAUTHORIZED = "identity_unauthorized",
  ENTITY_CREDENTIALS_INVALID = "invalid_credentials",
  ENTITY_INACTIVE = "entity_inactive",
  ENTITY_NOT_FOUND = "entity_not_found",
  ENTITY_CONFLICT = "entity_conflict",
  ENTITY_RELATION_INVALID = "entity_relation_invalid",
  REGISTRATION_DISABLED = "registration_disabled",
  PASSWORD_RECOVERY_DISABLED = "password_recovery_disabled",
  EMAIL_VERIFICATION_REQUIRED = "email_verification_required",
  RESET_TOKEN_EXPIRED = "reset_token_expired",
  LOGIN_ATTEMPT_THROTTLED = "login_attempt_throttled",
  MFA_ATTEMPT_THROTTLED = "mfa_attempt_throttled",
  MFA_NOT_CONFIGURABLE = "mfa_not_configurable",
  IDENTITY_PROVIDER_ACCOUNT_ALREADY_LINKED = "identity_provider_account_already_linked",
  IDENTITY_PROVIDER_ACCOUNT_UNLINK_BLOCKED = "identity_provider_account_unlink_blocked",
  STORAGE_INSUFFICIENT = "storage_insufficient",
  JWK_INVALID = "jwk_invalid",
  JWK_NOT_FOUND = "jwk_not_found",
  JWT_INVALID = "invalid_token",
  JWT_INACTIVE = "inactive_token",
  JWT_EXPIRED = "expired_token",
  OAUTH_REDIRECT_URI_MISMATCH = "redirect_uri_mismatch",
  OAUTH_CLIENT_INVALID = "invalid_client",
  OAUTH_CLIENT_UNAUTHORIZED = "unauthorized_client",
  OAUTH_GRANT_INVALID = "invalid_grant",
  OAUTH_GRANT_TYPE_UNSUPPORTED = "unsupported_token_grant_type",
  OAUTH_REQUEST_INVALID = "invalid_request",
  OAUTH_LOGIN_REQUIRED = "login_required",
  OAUTH_MFA_REQUIRED = "mfa_required",
  OAUTH_ACCESS_DENIED = "access_denied",
  OAUTH_INTERACTION_REQUIRED = "interaction_required",
  OAUTH_ACCOUNT_SELECTION_REQUIRED = "account_selection_required",
  OAUTH_CONSENT_REQUIRED = "consent_required",
  OAUTH_RESPONSE_TYPE_UNSUPPORTED = "unsupported_response_type",
  OAUTH_SCOPE_INVALID = "invalid_scope",
  OAUTH_SCOPE_INSUFFICIENT = "insufficient_scope",
  OAUTH_AUTHORIZATION_PENDING = "authorization_pending",
  OAUTH_SLOW_DOWN = "slow_down",
  OAUTH_DEVICE_CODE_EXPIRED = "device_code_expired",
  OAUTH_DEVICE_VERIFICATION_THROTTLED = "device_verification_throttled",
  PERMISSION_NOT_FOUND = "permission_not_found",
  PERMISSION_DENIED = "permission_denied",
  PERMISSION_EVALUATION_FAILED = "permission_evaluation_failed",
  POLICY_EVALUATOR_NOT_FOUND = "policy_evaluator_not_found",
  POLICY_EVALUATOR_NOT_PROCESSABLE = "policy_evaluator_not_processable",
  POLICY_EVALUATOR_CONTEXT_INVALID = "policy_evaluator_context_invalid"
}
//#endregion
//#region src/normalize.d.ts
/**
 * Normalize an arbitrary thrown value into an `Error` instance.
 *
 * Useful at error-pipeline boundaries (catch blocks, error middleware,
 * fallbacks) where TypeScript hands you `unknown` but downstream code
 * wants a real `Error` to inspect or rethrow. Duck-typed: any value
 * passing `isError` is returned as-is. Strings become `new Error(str)`;
 * any other value is stringified.
 */
export declare function normalizeError(input: unknown): Error;
//#endregion
//#region src/serialize.d.ts
/**
 * Convert an `Error` (or any value with a `toJSON()` method) into a
 * plain object suitable for embedding in a JSON response body.
 *
 * Calls `input.toJSON()` if present — preserves every attribute the
 * error chose to surface (`code`, `cause`, `errors`, `issues`, `data`,
 * AuthupError sub-class fields, ...). Falls back to spreading the
 * Error's enumerable own properties alongside the standard
 * `name` / `message` pair, so caller-attached fields survive.
 *
 * Pair with `normalizeError` to handle arbitrary thrown values:
 * `serializeError(normalizeError(e))`.
 */
export declare function serializeError(input: Error): Record<string, any>;
//#endregion
//#region src/status.d.ts
/**
 * Default mapping from `ErrorCode` to HTTP status. Adapters apply this and
 * may layer their own overrides on top. Codes not listed here fall back
 * to 400 (Bad Request) — which is the right default for "validation /
 * malformed-request" style errors.
 *
 * The mapping mirrors the HTTP statuses produced by the pre-refactor
 * `@ebec/http`-coupled error classes, with one intentional change:
 *
 * - `OAUTH_CLIENT_INVALID`: 400 → **401**, per RFC 6749 §5.2 (`invalid_client`
 *   responses should use 401). Surfaces as a behavior change in HTTP-level
 *   tests asserting `status: 400, code: OAUTH_CLIENT_INVALID`.
 * - The three `JWT_*` codes: 400 (the unlisted fallback) → **401**, per
 *   RFC 6750 §3.1, which is the status for a resource request carrying an
 *   expired or otherwise unusable bearer. They had never been listed, so a
 *   dead bearer answered 400 while a MISSING one answered 401, and no
 *   client could tell "your credential died" from "your request was
 *   malformed" by status alone. The token endpoint is where RFC 6749 §5.2
 *   and RFC 7662/7009 want something else, and each of its handlers says so
 *   at its own call site rather than here: the refresh grant re-throws a
 *   verification failure as `invalid_grant`, introspection reports one as
 *   `active: false`, and revocation answers its ordinary success. A new
 *   token-endpoint path that verifies a JWT has to do the same - this map
 *   cannot know which surface it is on.
 */
export declare const ERROR_CODE_TO_STATUS: Readonly<Partial<Record<`${ErrorCode}`, number>>>;
/**
 * Resolve an HTTP status for a given error code. Unknown codes fall back
 * to `fallback` (default 400).
 */
export declare function httpStatusFromCode(code: string, fallback?: number): number;
/**
 * Resolve a semantic `ErrorCode` for a foreign HTTP status. Used at the
 * boundary where a non-AuthupError (e.g. `@ebec/http` HTTPError thrown by
 * the framework, or a foreign service response) enters our system and
 * needs to be normalized into an `AuthupError` with an authup-vocabulary
 * code. Status is the only stable handshake across the two vocabularies.
 *
 * Default mapping covers the common HTTP statuses. Anything 5xx
 * collapses to `INTERNAL_ERROR`; unknown 4xx collapses to `BAD_REQUEST`.
 */
export declare function codeFromHttpStatus(status: number): ErrorCode;
//#endregion
export { BASE_ERROR_INSTANCE, INSTANCEOF_PROPERTY, hasInstanceof, markInstanceof, matchesInstanceof, serializeInstanceofChain };
//# sourceMappingURL=index.d.mts.map