import type { RuntimeGovernanceBoundary, RuntimeGovernanceCaller, RuntimeGovernanceDecisionStatus, RuntimeGovernanceGate } from "./runtimeGovernancePlane.js";
export type RuntimeScopeOperation = "read-state" | "mutate-state" | "invoke-tool" | "invoke-model" | "bridge-module" | "control-runtime";
export type RuntimeScopePermission = "runtime.read" | "runtime.write" | "tool.invoke" | "model.invoke" | "module.bridge" | "runtime.control";
export type RuntimeScopeGuardErrorCode = "MISSING_RUNTIME_ID" | "MISSING_CALLER" | "MISSING_OPERATION" | "UNKNOWN_OPERATION" | "RUNTIME_NOT_READY" | "GOVERNANCE_REJECTED" | "OPERATION_NOT_ALLOWED" | "SCOPE_DENIED";
export type RuntimeScopeGuardRequest = {
    runtimeId?: string;
    caller?: RuntimeGovernanceCaller;
    operation?: RuntimeScopeOperation;
    action?: string;
    grantedScopes?: readonly string[];
    requestedScopes?: readonly string[];
    allowedOperations?: readonly RuntimeScopeOperation[];
    runtimeReady?: boolean;
    governance?: RuntimeGovernanceGate;
};
export type RuntimeScopeGuardDecision = {
    status: RuntimeGovernanceDecisionStatus;
    runtimeId: string;
    operation: RuntimeScopeOperation;
    action?: string;
    caller: RuntimeGovernanceCaller;
    requiredScopes: readonly RuntimeScopePermission[];
    requestedScopes: readonly string[];
    grantedScopes: readonly string[];
    missingScopes: readonly string[];
    canReadState: boolean;
    canMutateState: boolean;
    canInvokeTool: boolean;
    canInvokeModel: boolean;
    canBridgeModule: boolean;
    canControlRuntime: boolean;
    readonly: boolean;
    unsafeSideEffects: false;
};
export type RuntimeScopeGuardError = {
    code: RuntimeScopeGuardErrorCode;
    message: string;
    boundary: RuntimeGovernanceBoundary;
    publicSafe: true;
};
export type RuntimeScopeGuardResult = {
    ok: true;
    decision: RuntimeScopeGuardDecision;
    events: readonly string[];
} | {
    ok: false;
    error: RuntimeScopeGuardError;
    events: readonly string[];
};
export declare const runtimeScopePermissionByOperation: Record<RuntimeScopeOperation, RuntimeScopePermission>;
export declare function guardRuntimeScope(request?: RuntimeScopeGuardRequest): RuntimeScopeGuardResult;
