/** Resolve `--tenant` (id or slug) / the stored default slug to a tenant ID. */
export declare function resolveTenantId(controlPlaneUrl: string, header: Record<string, string>, tenant: string | undefined): Promise<string>;
export declare function pullScope(opts: {
    controlPlaneUrl: string;
    header: Record<string, string>;
    tenantId: string;
    scopeId: string;
    full: boolean;
    outDir: string;
}): Promise<void>;
/**
 * `substrat scope restore <scopeId> --file <backup>` — the write half of `pull`
 * (preview-and-snapshots.md §8): load a backup into an EXISTING hosted scope,
 * REPLACING its data wholesale. The backup can be a `.sqlite` file (a `scope pull`
 * output, or a local `@substrat-run/adapter-sqlite` scope file — same shape) or a
 * `.dump.json`. The server side is the gate: staff-gated and audited; the restore
 * lands in the deployment the router actually serves the scope from.
 */
export declare function restoreScope(opts: {
    controlPlaneUrl: string;
    header: Record<string, string>;
    tenantId: string;
    scopeId: string;
    file: string;
}): Promise<void>;
/**
 * `substrat scope adopt-serving <scopeId>` — the builder-triggerable backfill (#286/#321):
 * move a LEGACY scope's data off its per-version dispatch script onto its vertical's stable
 * serving script, so a promote stops re-stranding it. Idempotent: an already-adopted scope
 * reports so and does nothing. Server-side is the gate (staff/owner, audited).
 */
export declare function adoptScopeServing(opts: {
    controlPlaneUrl: string;
    header: Record<string, string>;
    tenantId: string;
    scopeId: string;
}): Promise<void>;
/**
 * `substrat scope provision <scopeId>` — recover a scope stuck at "roles projected, zero tuples"
 * (#332): the enforcement flip switched on against an empty tuple table, so every login denies and
 * the owner is locked out with no lever. This re-runs the vertical's idempotent provision through
 * the control plane, which re-sources the owner from the vertical's own owner-of-record and restores
 * the grant. Authenticated with the builder's existing CP token — the platform secret never leaves
 * the control plane. Idempotent: safe to re-run on an already-healthy scope.
 */
export declare function provisionScope(opts: {
    controlPlaneUrl: string;
    header: Record<string, string>;
    tenantId: string;
    scopeId: string;
}): Promise<void>;
/**
 * `substrat scope status <scopeId>` — the DIRECTORY's truth about one scope (#424): its
 * status, the version it is bound to, the script serving it, and the role-projection
 * health check. This is the 10-second read that diagnosing a stuck install previously
 * required hand-rolled curl against the CP with the CLI's stored bearer.
 */
export declare function scopeStatus(opts: {
    controlPlaneUrl: string;
    header: Record<string, string>;
    tenantId: string;
    scopeId: string;
}): Promise<void>;
/**
 * `substrat scope bind <scopeId> --version <id>` — pin ONE scope to a specific version of the
 * SAME vertical (issue #509 ask (c)). This is the platform's most general rollout primitive
 * reached directly: a canary ("tenant A gets 0.3.0 first") or a pinned tenant is just this call
 * per scope, where a channel promote is a fleet-wide rebind. The route it hits already carries
 * the fork-before-promote gate — `--snapshot` archives the pre-migration data first when the
 * bind crosses a migration-digest boundary (a code-only rebind snapshots nothing), so a bad
 * version leaves a rollback point. A pending version is refused unless the scope is a preview.
 */
export declare function bindScopeVersion(opts: {
    controlPlaneUrl: string;
    header: Record<string, string>;
    tenantId: string;
    scopeId: string;
    versionId: string;
    snapshot?: boolean;
}): Promise<void>;
/**
 * `substrat scope rebind <scopeId> --to <slug>` — move ONE scope onto a DIFFERENT vertical
 * lineage's serving script (#389): the update-rebind behind retiring a platform-owned lineage
 * in favour of a tenant-owned one. Staff-only server-side. Refused when the two lineages'
 * migration digests differ, unless `--ack-migrations` says both diffs were read.
 */
export declare function rebindScopeVertical(opts: {
    controlPlaneUrl: string;
    header: Record<string, string>;
    tenantId: string;
    scopeId: string;
    vertical: string;
    ackMigrations: boolean;
    abandonData?: boolean;
}): Promise<void>;
/**
 * `substrat scope adopt-serving --vertical <slug>` — backfill EVERY still-legacy scope of a
 * vertical in one call. The whole-install migration a promote-per-scope would be tedious for.
 */
export declare function adoptVerticalServing(opts: {
    controlPlaneUrl: string;
    header: Record<string, string>;
    slug: string;
}): Promise<void>;
//# sourceMappingURL=scope.d.ts.map