/**
 * Structured fields attached to a `WasError`, sourced from the server's
 * `application/problem+json` response body.
 */
export interface WasErrorOptions {
    status?: number;
    /**
     * The problem-kind URI from the response body's `type` (e.g.
     * `https://wallet.storage/spec#quota-exceeded`), when the server sent one.
     */
    type?: string;
    title?: string;
    details?: string[];
    requestUrl?: string;
    cause?: unknown;
}
/**
 * Base class for all errors thrown by the high-level client methods.
 */
export declare class WasError extends Error {
    status?: number;
    type?: string;
    title?: string;
    details?: string[];
    requestUrl?: string;
    constructor(message: string, options?: WasErrorOptions);
}
/**
 * The target was not found -- or it exists but is not visible to the caller.
 * WAS returns 404 for both not-found and unauthorized, so a `NotFoundError`
 * means "not visible to you" rather than strictly "does not exist".
 */
export declare class NotFoundError extends WasError {
    name: string;
}
/**
 * The request was malformed or rejected as invalid (HTTP 400).
 */
export declare class ValidationError extends WasError {
    name: string;
}
/**
 * Authorization headers were missing or could not be verified (HTTP 401), or
 * the caller is authenticated but not permitted to act on the target (HTTP
 * 403).
 */
export declare class AuthRequiredError extends WasError {
    name: string;
}
/**
 * The endpoint exists in the spec but is not yet implemented by the server
 * (HTTP 501).
 */
export declare class NotImplementedError extends WasError {
    name: string;
}
/**
 * A client-side, fail-closed affordance gate: the operation needs an optional
 * backend feature the collection's backend does not advertise (e.g.
 * `chunked-streams` for an auto-routed large encrypted blob). Raised before any
 * request is sent, so it carries no HTTP status. Recover by writing to a
 * collection whose backend advertises the feature, or by keeping the payload
 * within what a single request can carry.
 */
export declare class NotSupportedError extends WasError {
    name: string;
}
/**
 * A client-supplied id or backend conflicts with existing state (HTTP 409):
 * `id-conflict` (the id already exists), `reserved-id` (the id collides with a
 * reserved path segment), or `unsupported-backend` (the backend id is not in
 * the space's available list). The specific kind is on the `type` URI.
 */
export declare class ConflictError extends WasError {
    name: string;
}
/**
 * A conditional write's precondition evaluated false (HTTP 412): an `ifMatch`
 * ETag did not match the Resource's current version (a lost-update conflict), or
 * an `ifNoneMatch` create-if-absent target already exists. Recover by re-reading
 * the current Resource (its new `etag`), re-applying the change, and retrying.
 * Distinct from `ConflictError` (409), which is the header-less id/backend
 * conflict family.
 */
export declare class PreconditionFailedError extends WasError {
    name: string;
}
/**
 * A single upload exceeded the target backend's `maxUploadBytes` constraint
 * (HTTP 413). Unlike `QuotaExceededError`, this is per-request -- a smaller
 * upload may still succeed.
 */
export declare class PayloadTooLargeError extends WasError {
    name: string;
}
/**
 * A write was rejected because the target backend's storage quota is exhausted
 * (HTTP 507). This is a client-actionable storage-full condition, not a server
 * fault.
 */
export declare class QuotaExceededError extends WasError {
    name: string;
}
/**
 * A client-side, fail-closed encryption error: a collection is declared
 * encrypted (by a per-handle override or its `encryption` descriptor) but this
 * client cannot build the codec -- no `encryption` provider is configured, or
 * the keystore holds no keys for the collection (or does not handle its
 * scheme). Raised before any request, so it carries no HTTP status; recover by
 * supplying the collection's keys (your keystore's `resolveKeys`, or a
 * per-handle `encryption` override). Never silently downgrades to plaintext.
 */
export declare class EncryptionError extends WasError {
    name: string;
}
/**
 * A fail-closed key-epoch error: a reader holds no key for an epoch it needs
 * on a multi-recipient encrypted Collection. Raised on two paths. Building a
 * codec raises it when none of the descriptor's `recipients` entries yield a
 * key for this reader's key-agreement key (it is a recipient of no epoch at
 * all). Decrypt routing raises it when a stored envelope's epoch IS on the
 * descriptor but wraps to no key this reader holds (it was never a recipient
 * of that epoch, or has been removed and the epoch rotated) -- the descriptor
 * is current, so re-reading it cannot help; contrast {@link UnknownEpochError},
 * where it can. A subtype of {@link EncryptionError}, so existing
 * `catch (EncryptionError)` fail-closed handling still catches it.
 *
 * This is the **read** axis only. It says nothing about **pull**: the reader may
 * still be served the ciphertext by the server (a separate zcap decision) and
 * may still hold earlier epochs' keys for resources written before it was
 * removed -- rotation is prospective and never claws back what a reader can
 * already decrypt.
 */
export declare class KeyUnwrapError extends EncryptionError {
    name: string;
}
/**
 * A fail-closed integrity error: a stored EDV envelope this reader DOES hold a
 * key for failed to authenticate on decrypt -- its AEAD tag did not verify, so
 * the ciphertext is corrupt or has been tampered with. Distinct from
 * {@link KeyUnwrapError}: that is the read/membership axis ("no key for this
 * epoch"), whereas this is a data-integrity failure by a legitimate recipient.
 * A subtype of {@link EncryptionError}, so existing `catch (EncryptionError)`
 * fail-closed handling still catches it, but a security-conscious caller can
 * `instanceof IntegrityError` to tell tampering apart from an authorization
 * problem. Raised client-side before/independent of any HTTP status.
 */
export declare class IntegrityError extends EncryptionError {
    name: string;
}
/**
 * A decrypt was attempted on an encrypt-only cipher. Raised by the cipher
 * `createEdvEncryptOnlyDocCipher` builds, which holds no key-agreement secret
 * at all: it seals writes to the descriptor's current epoch public key (the
 * epoch id IS the epoch key's did:key) and can never open anything. Its own
 * class so a caller that wired an encrypt-only cipher into a read path gets a
 * wiring signal, not a key-material failure; a subtype of
 * {@link EncryptionError}, so fail-closed handling still catches it. Matched
 * by `err.name` where the seam may resolve to another copy of this package.
 */
export declare class EncryptOnlyCipherError extends EncryptionError {
    name: string;
}
/**
 * The replication-port signal for a rejected conditional write (HTTP 412): an
 * `ifMatch` ETag did not match (a lost-update conflict) or an `ifNoneMatch`
 * create-if-absent target already exists. Thrown by a `WasSyncPort`
 * (`@interop/was-client/sync`) so a push loop can catch exactly the conflict
 * signal and re-read-and-reconcile, letting every other error propagate to its
 * backoff. A subtype of {@link PreconditionFailedError}, so a caller that
 * already handles 412 via `instanceof PreconditionFailedError` still catches it.
 */
export declare class WasSyncConflictError extends PreconditionFailedError {
    constructor(message?: string, options?: WasErrorOptions);
}
/**
 * The replication-port signal for a delete whose target resource is absent
 * (HTTP 404). For a delete this is a settled outcome (already gone, or the write
 * never reached the server), not a conflict, so a `WasSyncPort`
 * (`@interop/was-client/sync`) raises this distinct type rather than
 * {@link WasSyncConflictError}. A subtype of {@link NotFoundError}.
 */
export declare class WasSyncNotFoundError extends NotFoundError {
    constructor(message?: string, options?: WasErrorOptions);
}
/**
 * The replication-port signal for a request a WAS server refused on
 * authorization grounds: `401` (no verifiable invocation), `403` (authenticated
 * but not permitted), or the `404` a server returns when it MASKS an
 * authorization failure as "not found" so an unauthorized caller cannot probe
 * which resources exist. Carries the originating HTTP `status` so a caller can
 * tell the three apart.
 *
 * Opt-in: a `WasSyncPort` raises it only when built with `mapAuthErrors: true`
 * (`@interop/was-client/sync`), because the `404` reading is safe exactly when
 * the invoked Space and Collection are known to exist -- then a `404` can only
 * mean the invocation itself was rejected, i.e. the grant expired or was
 * revoked. A subtype of {@link AuthRequiredError}, so a caller that already
 * handles 401/403 via `instanceof AuthRequiredError` still catches it.
 */
export declare class WasSyncAuthError extends AuthRequiredError {
    constructor(status: number, options?: WasErrorOptions);
}
/**
 * The server encountered an internal fault (HTTP 5xx).
 */
export declare class WasServerError extends WasError {
    name: string;
}
/**
 * Thrown on decrypt when a stored envelope names JWE recipient (`kid`) ids
 * whose epochs the Collection Description does not list at all. It signals
 * that the caller's cached descriptor may be stale and should be re-read
 * before retrying: an epoch rotation emits no change-feed entry, so a codec
 * built from a pre-rotation descriptor meets envelopes stamped with a newer
 * epoch it has never seen.
 *
 * Distinct from {@link KeyUnwrapError}: when the descriptor DOES list the
 * envelope's epoch but this reader holds no key for it (it was never a
 * recipient of that epoch, or it was removed and the epoch rotated), decrypt
 * raises `KeyUnwrapError` instead -- the descriptor is current and re-reading
 * it cannot help.
 */
export declare class UnknownEpochError extends Error {
    constructor({ collectionId, kids }: {
        collectionId: string;
        kids: string[];
    });
}
/**
 * Reads the HTTP status from a raw ky/ezcap error, checking both the flat
 * `status` and the nested `response.status` shapes.
 *
 * @param err {unknown}   the caught error
 * @returns {number | undefined}
 */
export declare function httpStatus(err: unknown): number | undefined;
/**
 * Normalizes an unknown caught value into a display string: the `Error`'s
 * `message` when it is one, else its `String(...)` coercion. The companion to
 * {@link httpStatus} for the "log or surface what went wrong" half of a catch
 * block.
 *
 * @param err {unknown}   the caught error
 * @returns {string}
 */
export declare function errorMessage(err: unknown): string;
/**
 * Translates a thrown ky/ezcap error into the appropriate `WasError` subclass,
 * carrying through the server's `problem+json` fields. Dispatches on the
 * problem-kind `type` URI when the server sent one, falling back to the HTTP
 * status otherwise.
 *
 * @param err {unknown}   the caught error
 * @returns {WasError}
 */
export declare function mapError(err: unknown): WasError;
//# sourceMappingURL=errors.d.ts.map