/**
 * Operator scope system for fine-grained gateway API authorization.
 *
 * Each gateway API method maps to one or more required scopes.
 * Clients declare their scopes at connection time; the gateway enforces
 * that the declared scopes cover the method being invoked.
 */
export declare const ADMIN_SCOPE: "operator.admin";
export declare const READ_SCOPE: "operator.read";
export declare const WRITE_SCOPE: "operator.write";
export type OperatorScope = typeof ADMIN_SCOPE | typeof READ_SCOPE | typeof WRITE_SCOPE;
export declare const KNOWN_OPERATOR_SCOPES: ReadonlySet<OperatorScope>;
export declare function isOperatorScope(value: unknown): value is OperatorScope;
/** Default scopes granted to authenticated CLI / direct connections. */
export declare const DEFAULT_OPERATOR_SCOPES: OperatorScope[];
/**
 * Check whether a set of granted scopes satisfies the required scope for a route.
 */
export declare function authorizeRouteScope(routePath: string, grantedScopes: readonly OperatorScope[]): {
    allowed: true;
} | {
    allowed: false;
    requiredScope: OperatorScope;
};
/**
 * Check whether any of the granted scopes satisfies the required scope.
 */
export declare function authorizeScope(requiredScope: OperatorScope, grantedScopes: readonly OperatorScope[]): {
    allowed: true;
} | {
    allowed: false;
    requiredScope: OperatorScope;
};
/**
 * Parse scopes from a comma-separated header value.
 */
export declare function parseScopesHeader(headerValue: string | undefined): OperatorScope[];