/**
 * Every OAuth 2.0 protocol `error` value this server can emit. Each is
 * thrown by the handler noted alongside it (no dead codes).
 */
export const ProtocolError: Readonly<{
    INVALID_REQUEST: "invalid_request";
    INVALID_CLIENT: "invalid_client";
    INVALID_GRANT: "invalid_grant";
    UNAUTHORIZED_CLIENT: "unauthorized_client";
    UNSUPPORTED_GRANT_TYPE: "unsupported_grant_type";
    UNSUPPORTED_RESPONSE_TYPE: "unsupported_response_type";
    INVALID_SCOPE: "invalid_scope";
    ACCESS_DENIED: "access_denied";
    SERVER_ERROR: "server_error";
    TEMPORARILY_UNAVAILABLE: "temporarily_unavailable";
    UNSUPPORTED_TOKEN_TYPE: "unsupported_token_type";
    INVALID_TARGET: "invalid_target";
    INVALID_AUTHORIZATION_DETAILS: "invalid_authorization_details";
    INVALID_DPOP_PROOF: "invalid_dpop_proof";
    USE_DPOP_NONCE: "use_dpop_nonce";
    AUTHORIZATION_PENDING: "authorization_pending";
    SLOW_DOWN: "slow_down";
    EXPIRED_TOKEN: "expired_token";
    INVALID_CLIENT_METADATA: "invalid_client_metadata";
    INVALID_REDIRECT_URI: "invalid_redirect_uri";
}>;
/**
 * A protocol-level failure destined for the client over the wire. The
 * `code` is the OAuth `error` value; the `message` becomes
 * `error_description`. `redirectable` marks errors that belong in an
 * authorization-endpoint redirect (so the caller echoes `state`), as
 * opposed to a direct token/introspection/revocation JSON response.
 *
 * `invalid_client` is `401` (the client failed to authenticate); every
 * other protocol error is `400`. The authorization-endpoint redirect
 * errors never surface as an HTTP status — they ride the `Location`
 * query — so their `400` only applies when there is no usable
 * `redirect_uri` to bounce back to (see `response.js`).
 */
export class ServerError extends BaseError {
    static statuses: {
        invalid_client: number;
    };
    /**
     * @param {string} code                       a {@link ProtocolError} value
     * @param {string} message                    human-readable `error_description`
     * @param {{ cause?: unknown, status?: number, redirectable?: boolean, errorUri?: string, state?: string, headers?: Record<string,string> }} [options]
     */
    constructor(code: string, message: string, options?: {
        cause?: unknown;
        status?: number;
        redirectable?: boolean;
        errorUri?: string;
        state?: string;
        headers?: Record<string, string>;
    });
    /** @type {boolean} the error belongs in an authorize redirect, not a JSON body */
    redirectable: boolean;
    /** @type {string | undefined} RFC 6749 `error_uri` */
    errorUri: string | undefined;
    /** @type {string | undefined} `state` echoed on a redirect error */
    state: string | undefined;
    /** @type {Record<string,string> | undefined} extra response headers (e.g. `DPoP-Nonce`, `WWW-Authenticate`) */
    headers: Record<string, string> | undefined;
}
import { BaseError } from '@exortek/shared/errors';