/**
 * This Source Code is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * Copyright (c) Infonomic Company Limited
 */
/**
 * Auth-realm error factories.
 *
 * Shaped to match `@byline/core`'s `BylineError` / `createErrorType` conventions
 * (a `code` property and a factory that returns a thrown-ready error) without
 * depending on core — `@byline/auth` stays a leaf package so that core can
 * import types from it without circular risk.
 *
 * Consumers can:
 *   - `instanceof AuthError` to narrow,
 *   - `err.code === 'ERR_FORBIDDEN'` to branch on category,
 *   - catch and re-throw as a `BylineError` at the service boundary if the
 *     logger integration is wanted (Phase 4 call sites will do this).
 */
export declare const AuthErrorCodes: {
    readonly UNAUTHENTICATED: 'ERR_UNAUTHENTICATED';
    readonly FORBIDDEN: 'ERR_FORBIDDEN';
    readonly INVALID_CREDENTIALS: 'ERR_INVALID_CREDENTIALS';
    readonly INVALID_TOKEN: 'ERR_INVALID_TOKEN';
    readonly ACCESS_EXPIRED: 'ERR_ACCESS_EXPIRED';
    readonly SESSION_CHANGED: 'ERR_SESSION_CHANGED';
    readonly REVOKED_TOKEN: 'ERR_REVOKED_TOKEN';
    readonly ACCOUNT_DISABLED: 'ERR_ACCOUNT_DISABLED';
};
export type AuthErrorCode = (typeof AuthErrorCodes)[keyof typeof AuthErrorCodes];
export interface AuthErrorOptions {
    message: string;
    cause?: unknown;
}
export declare class AuthError extends Error {
    readonly code: AuthErrorCode;
    constructor(code: AuthErrorCode, options: AuthErrorOptions);
}
/** Throw when a request has no actor and the path requires one. */
export declare const ERR_UNAUTHENTICATED: (options: AuthErrorOptions) => AuthError;
/** Throw when the actor is known but lacks the required ability. */
export declare const ERR_FORBIDDEN: (options: AuthErrorOptions) => AuthError;
/**
 * Throw on sign-in when the email/password combination does not match a
 * known account. Message is intentionally generic — callers should not
 * distinguish "unknown email" from "wrong password" at this layer.
 */
export declare const ERR_INVALID_CREDENTIALS: (options: AuthErrorOptions) => AuthError;
/**
 * Throw when an access or refresh token is malformed, has a bad signature,
 * has expired, or otherwise cannot be verified.
 */
export declare const ERR_INVALID_TOKEN: (options: AuthErrorOptions) => AuthError;
/**
 * Throw when a refresh token has been revoked — either explicitly, or
 * because it was rotated and the caller is presenting a stale copy
 * (replay). Presenting a rotated token additionally revokes the entire
 * chain descended from it.
 */
export declare const ERR_REVOKED_TOKEN: (options: AuthErrorOptions) => AuthError;
/**
 * Throw when credentials / token are valid but the account has been
 * disabled (`is_enabled = false`).
 */
export declare const ERR_ACCOUNT_DISABLED: (options: AuthErrorOptions) => AuthError;
export declare const ERR_ACCESS_EXPIRED: (options: AuthErrorOptions) => AuthError;
export declare const ERR_SESSION_CHANGED: (options: AuthErrorOptions) => AuthError;