import type { RolesPolicy } from '../spi/roles-policy.js';
import type { Actor, ToolSpec } from '../types.js';
/**
 * The scopes a personal agent lacks to RUN a tool it is offered (`personalAgentGate`: a tool behind a
 * `scope:` role is offered to every personal agent, run only with that scope). `null` when the actor
 * is not a personal agent, the tool is not offered to it, or it may run it.
 *
 * The MCP provider answers such a `tools/call` with `403` + `WWW-Authenticate: Bearer
 * error="insufficient_scope", scope="…"` (RFC 6750 §3.1, MCP scope step-up), so the client can ask
 * the user for the scope instead of reading a generic tool error.
 */
export declare function missingScopes(actor: Actor, spec: ToolSpec, policy: RolesPolicy): Promise<string[] | null>;
//# sourceMappingURL=scope.d.ts.map