import { GraphorinSecretsError } from "../secrets/errors.js";

//#region src/auth/errors.d.ts

/**
 * Discriminator union for `TokenFormatError`. Lets callers branch on
 * the concrete failure mode without parsing the message string.
 *
 * @stable
 */
type TokenFormatErrorKind = 'empty-input' | 'wrong-prefix' | 'wrong-version' | 'wrong-length' | 'invalid-environment' | 'invalid-entropy' | 'invalid-checksum';
/**
 * Raised when a raw token does not match the canonical
 * `<prefix>_<env>_v1_<entropy>_<crc>` shape. The error never carries
 * the raw input; only its length and a stable `kind`.
 *
 * @stable
 */
declare class TokenFormatError extends GraphorinSecretsError {
  readonly kind: TokenFormatErrorKind;
  /** Length of the rejected input. The raw value is never logged. */
  readonly inputLength: number;
  constructor(kind: TokenFormatErrorKind, message: string, inputLength: number);
}
/**
 * Raised when `parseScope(...)` rejects an input. Scope strings have a
 * deliberately small grammar (`<resource>:<action>[:<id-or-glob>]`) so
 * the parser never silently coerces malformed inputs into a default.
 *
 * @stable
 */
declare class ScopeParseError extends GraphorinSecretsError {
  readonly kind: 'scope-parse-error';
  /** Original input string. Safe to log - never carries a secret. */
  readonly input: string;
  constructor(input: string, reason: string);
}
/**
 * Raised when `verifyToken(...)` is called from more concurrent in-
 * flight verifies than the configured cap allows. Used as a defensive
 * back-pressure signal under suspected DoS conditions; the HMAC verify
 * itself is too cheap to OOM the process, but a cap keeps log noise
 * and CPU contention bounded.
 *
 * @stable
 */
declare class TokenVerifyOverloadError extends GraphorinSecretsError {
  readonly kind: 'token-verify-overload';
  readonly inFlight: number;
  readonly cap: number;
  constructor(inFlight: number, cap: number);
}
/**
 * Raised when an IP or token has tripped the brute-force lockout. The
 * error carries the lockout source, the failing actor identifier, and
 * the wall-clock millisecond at which the lockout will lift.
 *
 * @stable
 */
declare class TokenLockedOutError extends GraphorinSecretsError {
  readonly kind: 'token-locked-out';
  readonly source: 'ip' | 'token';
  readonly identifier: string;
  readonly retryAfterMs: number;
  constructor(source: 'ip' | 'token', identifier: string, retryAfterMs: number);
}
/**
 * Raised when `createToken` / `rekeyTokens` are
 * invoked with a pepper value that fails the strength check - either
 * below the 32-byte minimum, or a low-entropy / placeholder value
 * (e.g. a long run of identical bytes). See `assessSecretStrength`.
 *
 * @stable
 */
declare class WeakPepperError extends GraphorinSecretsError {
  readonly kind: 'weak-pepper';
  readonly providedBytes: number;
  constructor(providedBytes: number, reason?: string);
}
//#endregion
export { ScopeParseError, TokenFormatError, TokenFormatErrorKind, TokenLockedOutError, TokenVerifyOverloadError, WeakPepperError };
//# sourceMappingURL=errors.d.ts.map