/**
 * postgres-mcp - OAuth Scopes
 *
 * Scope definitions and utilities for PostgreSQL MCP OAuth 2.1.
 */
import type { ToolGroup } from "../types/index.js";
/**
 * Standard OAuth scopes for postgres-mcp
 */
export declare const SCOPES: {
    /** Read-only access to all databases */
    readonly READ: "read";
    /** Read and write access to all databases */
    readonly WRITE: "write";
    /** Administrative access (VACUUM, ANALYZE, etc.) */
    readonly ADMIN: "admin";
    /** Full access to all operations */
    readonly FULL: "full";
};
export type StandardScope = (typeof SCOPES)[keyof typeof SCOPES];
/**
 * All supported scopes including patterns
 */
export declare const ALL_SCOPES: readonly ["read", "write", "admin", "full"];
/**
 * Base scopes supported by the server (without dynamic patterns)
 */
export declare const BASE_SCOPES: readonly ["read", "write", "admin", "full"];
/**
 * Regex patterns for validating dynamic scope strings
 */
export declare const SCOPE_PATTERNS: {
    /** Database-specific access pattern: db:{name} */
    readonly DATABASE: RegExp;
    /** Schema-specific access pattern: schema:{name} */
    readonly SCHEMA: RegExp;
    /** Table-specific access pattern: table:{schema}:{table} */
    readonly TABLE: RegExp;
};
/**
 * Map PostgreSQL tool groups to required minimum scopes
 */
export declare const TOOL_GROUP_SCOPES: Record<ToolGroup, StandardScope>;
/**
 * Per-tool scope overrides.
 *
 * The group-level mapping above is the default. These overrides raise
 * individual tools to the correct scope when the group default is too
 * permissive — most notably the `core` group, which contains both
 * read-only and destructive tools.
 *
 * BREAKING CHANGE: OAuth users with only `read` scope will lose access
 * to write/destructive core tools. They need `write` or `admin` scope.
 */
export declare const TOOL_SCOPE_OVERRIDES: Partial<Record<string, StandardScope>>;
/**
 * Parse scope string into array
 */
export declare function parseScopes(scopeString: string | undefined): string[];
/**
 * Check if granted scopes include the required scope
 */
export declare function hasScope(grantedScopes: string[], requiredScope: string): boolean;
/**
 * Check if granted scopes include any of the required scopes
 */
export declare function hasAnyScope(grantedScopes: string[], requiredScopes: string[]): boolean;
/**
 * Check if granted scopes include all of the required scopes
 */
export declare function hasAllScopes(grantedScopes: string[], requiredScopes: string[]): boolean;
/**
 * Get the required scope for a tool group
 */
export declare function getScopeForToolGroup(group: ToolGroup): StandardScope;
/**
 * Check if database-specific scope matches
 */
export declare function hasDatabaseScope(grantedScopes: string[], database: string): boolean;
/**
 * Check if schema-specific scope matches
 */
export declare function hasSchemaScope(grantedScopes: string[], schema: string): boolean;
/**
 * Check if table-specific scope matches
 */
export declare function hasTableScope(grantedScopes: string[], schema: string, table: string): boolean;
/**
 * Get scope display name
 */
export declare function getScopeDisplayName(scope: string): string;
//# sourceMappingURL=scopes.d.ts.map