/** Every capability scope a Personal Access Token / OAuth grant can carry. */
export declare const COMPANION_SCOPES: readonly ["chat", "voice", "call", "call.record", "call.video", "files", "events.subscribe", "worldstate.write", "ui.render", "data.activity", "chat.instructions", "memory.read:app", "memory.write:app", "memory.read:core", "memory.write:core", "skills.execute", "wallet.read", "wallet.spend", "social.message", "represent", "expose:knowledge", "expose:facts", "represent:pair", "represent:remember"];
export type CompanionScope = (typeof COMPANION_SCOPES)[number];
/** I/O modalities a key can carry alongside its scopes. */
export declare const COMPANION_MODALITIES: readonly ["text", "voice", "call", "files"];
export type CompanionModality = (typeof COMPANION_MODALITIES)[number];
/** Sensitive scopes — never granted by default; the user opts in at key
 *  creation, and execution still passes a confirm on a Pouchy-controlled
 *  surface (see `companion.confirm_request`). Not every non-default scope is
 *  opted into this way: `chat.instructions` is granted ONLY by the agent
 *  template's `instructions: true` flag, and a mint that names it is silently
 *  narrowed (CR-927). */
export declare const SENSITIVE_SCOPES: ReadonlySet<CompanionScope>;
/** The representative ("on-behalf-of") plane — a distinct axis from the
 *  execution scopes: one lets the companion ACT for the owner, the other lets
 *  it REPRESENT the owner to an outside visitor. `represent` is the umbrella;
 *  the `expose:*` / `represent:*` scopes only mean anything alongside it. */
export declare const REPRESENT_SCOPES: ReadonlySet<CompanionScope>;
/** What a freshly-generated key carries unless the user opts into more: a
 *  chat/play companion confined to its own app memory namespace. */
export declare const DEFAULT_SCOPES: readonly CompanionScope[];
export declare const DEFAULT_MODALITIES: readonly CompanionModality[];
export declare function isSensitiveScope(s: CompanionScope): boolean;
export declare function isRepresentScope(s: CompanionScope): boolean;
/** Does a granted scope set (e.g. `hello.ack.grantedScopes`) satisfy a
 *  required scope? Exact-match for v1 (no hierarchical wildcards). Use this for
 *  an EXACT-grant check ("was this scope explicitly granted?"). To gate a
 *  feature on whether an API CALL will succeed, prefer `grantsScope`, which
 *  also honours scope subsumption. */
export declare function hasScope(granted: readonly string[], required: CompanionScope): boolean;
/** Like {@link hasScope}, but honours the server's scope subsumptions — so a key
 *  granted only `wallet.spend` still `grantsScope(g, 'wallet.read')` (the API
 *  would serve the balance). Gate a read-only affordance (e.g. showing the
 *  wallet balance via `getWallet()`) on THIS, not `hasScope`, or the UI hides a
 *  feature the server would allow. For non-subsumed scopes it is identical to
 *  `hasScope`. */
export declare function grantsScope(granted: readonly string[], required: CompanionScope): boolean;
//# sourceMappingURL=scopes.d.ts.map