/**
 * Event auth errors — typed failures for cross-product event verification.
 *
 * ADR-ECO-017: verifyEvent throws typed errors for each failure mode.
 * Consumers MUST catch and handle these explicitly (no silent ignore).
 *
 * @module auth/errors
 * @public
 */
/** Thrown when the event's HMAC signature does not match the recomputed value. */
export declare class InvalidSignatureError extends Error {
    constructor(message?: string);
}
/**
 * Thrown when the event timestamp is outside the acceptable clock skew window.
 * Default window: 5 minutes (±300 000 ms).
 */
export declare class ClockSkewError extends Error {
    readonly skewMs: number;
    constructor(skewMs: number);
}
/**
 * Thrown when the nonce (idempotencyKey) has already been seen within the TTL window.
 * Indicates a replay attack or duplicate delivery.
 */
export declare class ReplayDetectedError extends Error {
    readonly idempotencyKey: string;
    constructor(idempotencyKey: string);
}
/**
 * Thrown when the event's source field is not in the allowed enum.
 * Allowed sources: forge | vauban | vauban-finance | brain | citadel | glacis | cc | tenant
 */
export declare class UnknownSourceError extends Error {
    readonly source: string;
    constructor(source: string);
}
//# sourceMappingURL=errors.d.ts.map