/**
 * memory-journal-mcp — OAuth Scopes
 *
 * Scope definitions and enforcement utilities for
 * granular access control.
 *
 * Scope Hierarchy:  full ⊃ admin ⊃ write ⊃ read
 *
 * Note: memory-journal-mcp uses only base scopes (no wildcard patterns).
 */
import type { ToolGroup } from '../types/index.js';
/**
 * Standard OAuth scopes for memory-journal-mcp
 */
export declare const SCOPES: {
    /** Read-only access */
    readonly READ: "read";
    /** Read and write access */
    readonly WRITE: "write";
    /** Administrative access */
    readonly ADMIN: "admin";
    /** Unrestricted access to all operations */
    readonly FULL: "full";
    /** Team operations access */
    readonly TEAM: "team";
    /** Audit log access */
    readonly AUDIT: "audit";
};
export type StandardScope = (typeof SCOPES)[keyof typeof SCOPES];
/**
 * Base scopes supported by the server
 */
export declare const BASE_SCOPES: readonly ["read", "write", "admin", "full", "team", "audit"];
/**
 * All supported scope patterns for metadata
 */
export declare const SUPPORTED_SCOPES: readonly ["read", "write", "admin", "full", "team", "audit"];
/**
 * Declarative mapping from tool group to required minimum scope.
 * Single source of truth — all other scope-group arrays derive from this.
 */
export declare const TOOL_GROUP_SCOPES: Record<ToolGroup, StandardScope>;
/**
 * Per-tool scope overrides. These tools require different scopes than their group default.
 */
export declare const TOOL_SCOPE_OVERRIDES: Record<string, StandardScope>;
/**
 * Get the required scope for a tool group.
 */
export declare function getScopeForToolGroup(group: ToolGroup): StandardScope;
/**
 * Tool groups accessible with read scope (read-only operations)
 */
export declare const READ_SCOPE_GROUPS: ToolGroup[];
/**
 * Tool groups accessible with write scope (read + write operations)
 */
export declare const WRITE_SCOPE_GROUPS: ToolGroup[];
/**
 * Tool groups accessible with admin scope (all operations)
 */
export declare const ADMIN_SCOPE_GROUPS: ToolGroup[];
/**
 * Parse a scope string (space-delimited) into an array
 */
export declare function parseScopes(scopeString: string): string[];
/**
 * Check if a scope is valid (matches known scopes)
 */
export declare function isValidScope(scope: string): boolean;
/**
 * Check if granted scopes include the required scope.
 * Respects the scope hierarchy: full ⊃ admin ⊃ write ⊃ read
 */
export declare function hasScope(grantedScopes: string[], requiredScope: string): boolean;
/**
 * Check if granted scopes include any of the required scopes
 */
export declare function hasAnyScope(grantedScopes: string[], requiredScopes: string[]): boolean;
/**
 * Check if granted scopes include all of the required scopes
 */
export declare function hasAllScopes(grantedScopes: string[], requiredScopes: string[]): boolean;
/**
 * Check if scopes include admin access
 */
export declare function hasAdminScope(scopes: string[]): boolean;
/**
 * Check if scopes include write access
 */
export declare function hasWriteScope(scopes: string[]): boolean;
/**
 * Check if scopes include read access
 */
export declare function hasReadScope(scopes: string[]): boolean;
/**
 * Get the required minimum scope for a tool group
 */
export declare function getRequiredScopeForGroup(group: ToolGroup): string;
/**
 * Get tool groups accessible with given scopes
 */
export declare function getAccessibleToolGroups(scopes: string[]): ToolGroup[];
/**
 * Get all tools accessible with given scopes
 */
export declare function getAccessibleTools(scopes: string[]): string[];
/**
 * Get human-readable display name for a scope
 */
export declare function getScopeDisplayName(scope: string): string;
//# sourceMappingURL=scopes.d.ts.map