import type { RemoteRiskLevel, RemoteScope } from './protocol.js';
export interface RemoteIdentity {
    userId: string;
    scopes: readonly RemoteScope[];
    expiresAt?: Date;
}
export type ScopeCheckResult = {
    ok: true;
} | {
    ok: false;
    code: 'IDENTITY_MISSING' | 'IDENTITY_EXPIRED' | 'SCOPE_MISSING';
    message: string;
};
export declare function requiredScopeForRisk(riskLevel: RemoteRiskLevel): RemoteScope;
export declare function hasRemoteScope(identity: RemoteIdentity, scope: RemoteScope): boolean;
export declare function checkRemoteScope(identity: RemoteIdentity | undefined, riskLevel: RemoteRiskLevel, now?: Date): ScopeCheckResult;