/**
 * Minimal protocol-bound scope shape used by permission grant authorization.
 *
 * Permission grants and candidate records/filters are projected down to these
 * fields before matching so grant selection and server enforcement use the
 * same rules.
 */
export type ProtocolScope = {
    protocol?: string;
    protocolPath?: string;
    contextId?: string;
};
/**
 * Shared matching rules for protocol-scoped permission grants.
 *
 * Matching fails closed for invalid combinations: `protocolPath` and
 * `contextId` are mutually exclusive, and either field requires `protocol`.
 * `protocol` matches by exact equality. `protocolPath` and `contextId` scopes
 * match subtrees: the target value must equal the scoped value or begin with the
 * scoped value followed by `/`.
 */
export declare class PermissionScopeMatcher {
    /**
     * Determines whether a candidate target is within a grant scope.
     */
    static matches(scope: ProtocolScope, target: ProtocolScope): boolean;
    private static matchesContextId;
    private static matchesSubtree;
}
//# sourceMappingURL=permission-scope.d.ts.map