import type { ProviderResourceSelectors, Scope } from "@termfleet/core/teams/provider-access-token.js";
export declare class ScopeDeniedError extends Error {
    readonly code = "scope-denied";
    readonly status = 403;
    constructor(scope: Scope);
}
export type ProviderResourceSelectorKind = "agent-session" | "porthole" | "terminal" | "window";
export declare class ProviderResourceDeniedError extends Error {
    readonly code = "resource-selector-denied";
    readonly status = 403;
    constructor(kind: ProviderResourceSelectorKind | "provider", id?: number | string);
}
export declare class ProviderAccessExpiredError extends Error {
    readonly code = "provider-access-expired";
    readonly status = 401;
    constructor();
}
export declare function assertScopeAllowed(scopes: Scope[] | undefined, required: Scope): void;
export declare function assertProviderResourceAllowed(selectors: ProviderResourceSelectors | undefined, kind: ProviderResourceSelectorKind, id: number | string): void;
export declare function assertProviderAccessFresh(expireAt: number | undefined, now?: number): void;
export declare function assertProviderWideAccess(selectors: ProviderResourceSelectors | undefined): void;
export declare function assertProviderHttpResourceAllowed(selectors: ProviderResourceSelectors | undefined, url: URL): void;
export declare function resolveProviderHttpRouteScope(method: string, pathname: string): Scope | undefined;