export type RuntimeAccessSessionActorKind = "application" | "official-module" | "operator" | "runtime-surface" | "external-control";
export type RuntimeAccessSessionBoundary = "input" | "contract" | "governance" | "runtime-state" | "scope" | "session";
export type RuntimeAccessSessionErrorCode = "MISSING_RUNTIME_ID" | "MISSING_ACTOR" | "MISSING_ACTOR_ID" | "RUNTIME_NOT_READY" | "CONTRACT_REJECTED" | "GOVERNANCE_REJECTED" | "SCOPE_DENIED" | "SESSION_EXPIRED";
export type RuntimeAccessSessionGate = {
    accepted: boolean;
    reason?: string;
};
export type RuntimeAccessSessionActor = {
    kind: RuntimeAccessSessionActorKind;
    id: string;
    moduleId?: string;
    displayName?: string;
};
export type RuntimeAccessSessionRequest = {
    runtimeId?: string;
    actor?: RuntimeAccessSessionActor;
    sessionId?: string;
    requestedScopes?: readonly string[];
    grantedScopes?: readonly string[];
    deniedScopes?: readonly string[];
    issuedAt?: string;
    expiresAt?: string;
    runtimeReady?: boolean;
    contract?: RuntimeAccessSessionGate;
    governance?: RuntimeAccessSessionGate;
};
export type RuntimeAccessSession = {
    sessionId: string;
    runtimeId: string;
    actor: RuntimeAccessSessionActor;
    scopes: readonly string[];
    requestedScopes: readonly string[];
    deniedScopes: readonly string[];
    issuedAt?: string;
    expiresAt?: string;
    active: true;
    dryRunOnly: true;
    unsafeSideEffects: false;
};
export type RuntimeAccessSessionError = {
    code: RuntimeAccessSessionErrorCode;
    message: string;
    boundary: RuntimeAccessSessionBoundary;
    safeForApplication: true;
    internalDetailExposed: false;
};
export type RuntimeAccessSessionResult = {
    ok: true;
    session: RuntimeAccessSession;
    events: readonly string[];
} | {
    ok: false;
    error: RuntimeAccessSessionError;
    events: readonly string[];
};
export declare const runtimeAccessSessionDescriptor: {
    readonly surface: "runtime.managementPlane";
    readonly capability: "runtimeAccessSession";
    readonly purpose: "create a narrow, auditable management access session for runtime control surfaces";
    readonly mode: "dry-run";
    readonly unsafeSideEffects: false;
};
export declare function isRuntimeAccessSessionActive(session: RuntimeAccessSession, nowIso?: string): boolean;
export declare function createRuntimeAccessSession(request?: RuntimeAccessSessionRequest): RuntimeAccessSessionResult;
