/**
 * Authorization scope vocabulary — extracted into its own module to avoid a
 * dependency cycle between `principal.ts` and `authorization.ts`.
 *
 * All authorization-scope-related types and runtime helpers live here. Access
 * policies, scope requirements, and the access-check pipeline live in
 * `authorization.ts`.
 */
/**
 * All authorization scopes recognized by the runtime. Full-word, colon-separated,
 * one entry per (domain, action) pair. Add new scopes here when introducing a
 * new domain; never derive scope strings dynamically.
 *
 * Scope semantics are deliberately FLAT for v1 — `workflows:admin` does NOT
 * imply `workflows:read` or `workflows:write`. Operation authors must declare
 * the exact scope they require. Scope-implication semantics (if any) are a
 * future track.
 *
 * Public export so dashboards and API-key provisioning tooling can consume
 * the canonical vocabulary instead of hand-copying it.
 *
 * @example
 * ```ts
 * import { AUTHORIZATION_SCOPES } from '@lostgradient/weft/server';
 *
 * console.log(AUTHORIZATION_SCOPES.includes('workflows:read'));
 * ```
 */
export declare const AUTHORIZATION_SCOPES: readonly ["workflows:read", "workflows:write", "workflows:admin", "schedules:read", "schedules:write", "signals:write", "updates:write", "queries:read", "reviews:read", "reviews:write", "attributes:read", "attributes:write", "tags:write", "streams:read", "events:read", "storage:read", "storage:write", "storage:admin", "workers:write", "system:read", "system:admin"];
/**
 * String-literal union of every authorization scope.
 *
 * @example
 * ```ts
 * import { type AuthorizationScope } from '@lostgradient/weft/server';
 *
 * const scope: AuthorizationScope = 'workflows:read';
 * console.log(scope);
 * ```
 */
export type AuthorizationScope = (typeof AUTHORIZATION_SCOPES)[number];
/**
 * Runtime type guard for the `AuthorizationScope` union.
 *
 * @example
 * ```ts
 * import { isAuthorizationScope } from '@lostgradient/weft/server';
 *
 * console.log(isAuthorizationScope('workflows:read'));
 * console.log(isAuthorizationScope('not-a-scope'));
 * ```
 */
export declare function isAuthorizationScope(value: string): value is AuthorizationScope;
/**
 * Extract the full set of scopes granted by a JWT payload by *merging* every
 * recognized claim source. Real-world tokens commonly carry OIDC scopes (e.g.
 * `openid profile`) in `scope` while application scopes live in `permissions`;
 * a short-circuit on the first present claim would silently drop privileges.
 *
 * Sources merged (all consulted, all unioned):
 *   - `scope` — RFC 8693-style space-delimited string
 *   - `scp` — alternate space-delimited string used by some IdPs
 *   - `permissions` — array of strings
 *
 * Whitespace-only values are treated as absent so they never block fallback to
 * other sources. Unknown scope strings are silently filtered out — the
 * vocabulary in `AUTHORIZATION_SCOPES` is the single source of truth and a
 * misspelled scope cannot grant unintended privileges.
 *
 * Credential *validation* (signature verification, expiry, revocation) happens
 * at the transport edge before the claims object reaches this function.
 */
export declare function extractScopesFromClaims(claims: Record<string, unknown>): ReadonlySet<AuthorizationScope>;