import type { TRegisterErrors } from '@venizia/ignis-helpers/core';
/** Codes a client branches on for a refused authorization. A throw site may override `message` for detail; the code and status come from here. */
export declare const AuthorizationErrors: {
    readonly UNAUTHENTICATED: {
        readonly message: {
            readonly text: "Authorization requires an authenticated user";
            readonly code: "core.authorization.unauthenticated";
        };
        readonly statusCode: 401;
        readonly category: "auth";
    };
    readonly DENIED: {
        readonly message: {
            readonly text: "Authorization denied";
            readonly code: "core.authorization.denied";
        };
        readonly statusCode: 403;
        readonly category: "auth";
    };
    /** Distinct from {@link DENIED}: a voter refused before the enforcer ever ran. */
    readonly DENIED_BY_VOTER: {
        readonly message: {
            readonly text: "Authorization denied by voter";
            readonly code: "core.authorization.denied_by_voter";
        };
        readonly statusCode: 403;
        readonly category: "auth";
    };
    /** Distinct from {@link DENIED}: no enforcer ever ran - the route declared `authorize()` but the application registered none, and `defaultDecision` did not say ALLOW. */
    readonly ENFORCER_NOT_REGISTERED: {
        readonly message: {
            readonly text: "Authorization requires an enforcer, but none is registered";
            readonly code: "core.authorization.enforcer_not_registered";
        };
        readonly statusCode: 403;
        readonly category: "auth";
    };
    readonly PRINCIPAL_TYPE_MISSING: {
        readonly message: {
            readonly text: "user.principalType is required for enforcer-based authorization";
            readonly code: "core.authorization.principal_type_missing";
        };
        readonly statusCode: 400;
        readonly category: "validation";
    };
    readonly CACHE_KEY_INVALID: {
        readonly message: {
            readonly text: "Authorization cache key resolver returned an empty key";
            readonly code: "core.authorization.cache_key_invalid";
        };
        readonly statusCode: 400;
        readonly category: "validation";
    };
};
/** Registers these codes with the shared key registry so a consumer gets autocomplete on `messageCode`. Augments the `/core` subpath, not the root barrel - kernel never imports the bare package, so nothing else in this program would make the root specifier resolvable for the merge. */
declare module '@venizia/ignis-helpers/core' {
    interface IErrorKeyRegistry extends TRegisterErrors<typeof AuthorizationErrors> {
    }
}
//# sourceMappingURL=errors.d.ts.map