import type { AuthorizedWorkspaceScope, AuthorizedWorkspaceScopeResult, CloudWorkspaceContext } from './types.js';
export type WorkspaceScopedQuery<T extends Record<string, unknown>> = Omit<T, 'workspaceId'> & {
    workspaceId: string;
};
export declare class WorkspaceScopingError extends Error {
    readonly workspaceId: string;
    readonly requestedWorkspaceId: string;
    constructor(workspaceId: string, requestedWorkspaceId: string);
}
export declare function scopeToWorkspace<T extends {
    workspaceId: string;
}>(resource: T, requestedWorkspaceId: string): T | null;
export declare function createWorkspaceScopedQuery<T extends Record<string, unknown> = Record<string, never>>(workspaceId: string, query?: T): WorkspaceScopedQuery<T>;
export declare function assertWorkspaceMatch(resourceWorkspaceId: string, requestWorkspaceId: string): void;
/**
 * Resolve a request's workspace scope against the caller's authorized scope.
 *
 * Denies cross-workspace access, and denies cross-project / cross-environment
 * access when the authorized scope pins those dimensions. When the authorized
 * scope pins a `projectId` or `environment` and the request omits it, the
 * authorized value is filled into the resolved scope (defaults to authorized
 * scope rather than rejecting). Callers that require the request to name a
 * project explicitly should compose with
 * `validateWorkspaceContext(..., { requireProject: true })`.
 */
export declare function resolveAuthorizedWorkspaceScope(authorizedScope: AuthorizedWorkspaceScope, requestedScope: CloudWorkspaceContext): AuthorizedWorkspaceScopeResult;
