/**
 * Tool→scope policy primitives.
 *
 * TypeScript parity port of python/runtime/policy.py.
 *
 * The authoritative tool→scope mapping lives in AuthSec's Scope Matrix UI.
 * When ``resourceServerId`` is set in Config, the SDK fetches this mapping
 * from AuthSec at startup and refreshes it periodically. Developers do not
 * need to maintain tool→scope mappings in code.
 *
 * A ToolScopeMap can also be set directly via ``Config.toolScopes`` as a
 * local defense-in-depth fallback.
 */
/**
 * The mapping shape returned from the scope matrix endpoint, including the
 * structured form with ``policy_complete`` and ``tools``.
 *
 * The keys of ``tools`` are tool ids; the value lists the OAuth scopes
 * required (empty array == public).
 */
export interface ToolScopeMap {
    policy_complete: boolean;
    tools: Record<string, {
        required_any: string[];
    }>;
}
/** Three-state outcome of `lookupTool`. */
export type ToolPolicyOutcome = 'absent' | 'public' | 'scoped';
/**
 * Result of resolving a tool against the policy. ``denied`` is set with a
 * short reason string when the policy says the tool must be denied (e.g. it
 * was absent from a non-OPEN policy, or the policy was incomplete).
 */
export interface ToolPolicyResult {
    outcome: ToolPolicyOutcome;
    required_any: string[];
    denied?: string;
}
/**
 * Look up a tool in the policy map. Returns a typed result with the required
 * scopes (empty for ABSENT / PUBLIC). Callers must combine this with the
 * effective policy mode to decide whether to allow an absent tool.
 */
export declare function lookupTool(matrix: ToolScopeMap | null | undefined, toolId: string): ToolPolicyResult;
/** True iff any of ``granted`` is in ``required``; empty required is OK. */
export declare function hasAnyRequired(required: string[], granted: Set<string> | string[]): boolean;
/**
 * Build a ToolScopeMap from the simpler ``Record<string, string[]>`` shape
 * that Config.toolScopes uses. Empty array → public.
 */
export declare function toolScopeMapFromRecord(record: Record<string, string[]> | null | undefined): ToolScopeMap | null;
//# sourceMappingURL=policy.d.ts.map