export declare const POLICY_WRITE_SCOPE_TRUNCATED: "POLICY_WRITE_SCOPE_TRUNCATED";
export interface CredentialScopeDiagnostic {
    policyTruncated?: boolean;
    droppedWriteGrantPrefixes?: string[];
    retainedGrantPrefixes?: string[];
}
/**
 * Raised before an upload receives credentials that silently omit legitimate
 * write grants. Prefix arrays are preserved for programmatic callers; the
 * message is safe and actionable for CLI rendering.
 */
export declare class VaultCredentialScopeError extends Error {
    readonly droppedWriteGrantPrefixes: string[];
    readonly retainedGrantPrefixes: string[];
    readonly statusCode: number;
    readonly code: "POLICY_WRITE_SCOPE_TRUNCATED";
    constructor(droppedWriteGrantPrefixes: string[], retainedGrantPrefixes?: string[], statusCode?: number, serverMessage?: string, remediation?: string);
}
export declare function credentialScopeErrorFromBody(body: string, statusCode: number): VaultCredentialScopeError | null;
export declare function assertCredentialScopeUsable(diagnostic: CredentialScopeDiagnostic): void;
//# sourceMappingURL=credential-scope-error.d.ts.map