export declare const MCP_SCOPE_VALUES: readonly ["mcp", "mcp:read", "mcp:call", "mcp:billing"];
export type McpScopeValue = (typeof MCP_SCOPE_VALUES)[number];
export type McpCapability = "read" | "call" | "billing";
export declare class InvalidMcpScopeError extends Error {
    constructor(message: string);
}
/**
 * Normalize client registration scope. An omitted registration keeps the
 * backwards-compatible full `mcp` grant, while explicit empty or unknown
 * values are rejected instead of silently escalating to it.
 */
export declare function normalizeRegisteredMcpScope(value: string | undefined | null): string;
/**
 * Resolve the scope placed on an authorization code. Omitted scope inherits
 * the client's registered grant. An explicit request must be a subset of that
 * grant; `mcp` is the backwards-compatible umbrella grant.
 */
export declare function resolveGrantedMcpScope(registeredScope: string, requestedScope: string | undefined | null): string;
export declare function mcpScopeAllows(scope: unknown, capability: McpCapability): boolean;
export declare const MCP_TOOL_CAPABILITY: {
    readonly apiclaw_help: "read";
    readonly discover_apis: "read";
    readonly get_api_details: "read";
    readonly list_categories: "read";
    readonly list_connected: "read";
    readonly list_models: "read";
    readonly call_api: "call";
    readonly check_balance: "billing";
    readonly check_workspace_status: "billing";
    readonly list_mission_templates: "read";
    readonly start_mission: "call";
    readonly discover_missions: "read";
    readonly mission_status: "read";
    readonly list_missions: "read";
};
export declare function requiredMcpCapabilityForTool(toolName: string): McpCapability | null;
export declare function mcpScopeAllowsTool(scope: unknown, toolName: string): boolean;
export declare function filterMcpToolsForScope<T extends {
    name: string;
}>(scope: unknown, tools: readonly T[]): T[];
//# sourceMappingURL=mcp-scope-policy.d.ts.map