//#region src/secrets/errors.d.ts
/**
 * Typed error classes raised by the secrets layer of `@graphorin/security`.
 *
 * Every error carries a stable lowercase `kind` so downstream code can
 * branch without parsing messages, plus a `hint` field that points at a
 * remediation step (CLI command or doc reference) where appropriate.
 *
 * @packageDocumentation
 */
/**
 * Base class for every error thrown by the secrets layer. Carries a
 * stable `kind` discriminator and optional `hint`.
 *
 * @stable
 */
declare class GraphorinSecretsError extends Error {
  /** Stable lowercase discriminator. Subclasses fix this to a literal. */
  readonly kind: string;
  /** Optional remediation hint (CLI command or doc link). */
  readonly hint?: string;
  constructor(kind: string, message: string, options?: {
    cause?: unknown;
    hint?: string;
  });
}
/**
 * Discriminator union for `SecretRefParseError`. Lets callers branch on
 * the failure mode without parsing the message string.
 *
 * @stable
 */
type SecretRefParseErrorKind = 'empty-input' | 'malformed-uri' | 'invalid-scheme' | 'unknown-scheme' | 'missing-authority' | 'unexpected-authority' | 'empty-path' | 'invalid-percent-encoding' | 'naked-string';
/**
 * Raised when `parseSecretRef(...)` rejects an input. The parser is
 * strict-by-default and never silently falls through to a default
 * resolver - typos in `*Ref` config fields surface here at bootstrap.
 *
 * @stable
 */
declare class SecretRefParseError extends GraphorinSecretsError {
  readonly kind: SecretRefParseErrorKind;
  /** Original input string. Safe to log - never carries a secret value (naked-string inputs are stored REDACTED: 4-char head + length). */
  readonly input: string;
  /** Optional offset into `input` where the parser stopped. */
  readonly position?: number;
  constructor(kind: SecretRefParseErrorKind, message: string, input: string, position?: number, options?: {
    cause?: unknown;
    hint?: string;
  });
}
/**
 * Raised by the resolver dispatcher when no resolver is registered for
 * the parsed scheme. Suggests `registerResolver(...)` as the fix.
 *
 * @stable
 */
declare class UnknownSchemeError extends GraphorinSecretsError {
  readonly kind: 'unknown-scheme';
  /** Lowercased scheme that failed lookup. */
  readonly scheme: string;
  /** Original ref input - safe to log. */
  readonly ref: string;
  constructor(scheme: string, ref: string);
}
/**
 * Raised by `resolveSecret(...)` when a resolver matched the scheme but
 * returned `null` (resolved to "not found").
 *
 * @stable
 */
declare class SecretResolutionError extends GraphorinSecretsError {
  readonly kind: 'resolution-failed';
  /** Lowercased scheme that ran. */
  readonly scheme: string;
  /** Original ref input - safe to log. */
  readonly ref: string;
  constructor(scheme: string, ref: string, reason: string, options?: {
    cause?: unknown;
  });
}
/**
 * Raised when a `literal:` ref is encountered without all three gates
 * (env flag + config flag + non-production NODE_ENV with a special
 * override) being satisfied.
 *
 * @stable
 */
declare class LiteralSecretsForbiddenError extends GraphorinSecretsError {
  readonly kind: 'literal-secrets-forbidden';
  constructor(reason: string);
}
/**
 * Raised by `SecretsStore.require(...)` when the requested key is not
 * present in the active store.
 *
 * @stable
 */
declare class SecretRequiredError extends GraphorinSecretsError {
  readonly kind: 'secret-required';
  /** The secret key that was missing. Safe to log. */
  readonly key: string;
  constructor(key: string);
}
/**
 * Raised when a tool calls `ctx.secrets.require(key)` with a key that
 * is not in its declared `secretsAllowed` allowlist.
 *
 * @stable
 */
declare class SecretAccessDeniedError extends GraphorinSecretsError {
  readonly kind: 'secret-access-denied';
  /** The denied secret key. */
  readonly key: string;
  /** Tool that issued the request. */
  readonly toolName: string;
  /** Snapshot of the currently-effective allowlist. */
  readonly allowedSet: ReadonlyArray<string>;
  constructor(key: string, toolName: string, allowedSet: ReadonlyArray<string>);
}
/**
 * Raised by `MemorySecretsStore` when constructed in a production-mode
 * process without the explicit `forceProduction` opt-out.
 *
 * @stable
 */
declare class MemoryStoreInProductionError extends GraphorinSecretsError {
  readonly kind: 'memory-store-in-production';
  constructor();
}
/**
 * Raised by the factory when `--strict-secrets` is set and the requested
 * primary store is unavailable on the current host.
 *
 * @stable
 */
declare class StrictSecretsUnavailableError extends GraphorinSecretsError {
  readonly kind: 'strict-secrets-unavailable';
  /** Identifier of the source that was requested. */
  readonly source: string;
  /** Reasons the store could not be activated. */
  readonly reasons: ReadonlyArray<string>;
  constructor(source: string, reasons: ReadonlyArray<string>);
}
/**
 * Raised when an optional native peer dependency required by a
 * `SecretsStore` (e.g. `@napi-rs/keyring`, `@node-rs/argon2`) is missing.
 *
 * @stable
 */
declare class MissingPeerDependencyError extends GraphorinSecretsError {
  readonly kind: 'missing-peer-dependency';
  /** npm package name that was missing. */
  readonly packageName: string;
  constructor(packageName: string, used_by: string, options?: {
    cause?: unknown;
  });
}
//#endregion
export { GraphorinSecretsError, LiteralSecretsForbiddenError, MemoryStoreInProductionError, MissingPeerDependencyError, SecretAccessDeniedError, SecretRefParseError, SecretRefParseErrorKind, SecretRequiredError, SecretResolutionError, StrictSecretsUnavailableError, UnknownSchemeError };
//# sourceMappingURL=errors.d.ts.map