import { RealmScope } from './constants';
/**
 * Coerce an arbitrary value to a RealmScope, defaulting to `own` for missing /
 * null / unknown input (fail-closed). `none` is honoured only when explicit.
 */
export declare function normalizeRealmScope(value?: `${RealmScope}` | null): `${RealmScope}`;
/**
 * Numeric comparison of two realm scopes by restrictiveness.
 * Negative when `a` is more restrictive than `b`, positive when less.
 */
export declare function compareRealmScope(a?: `${RealmScope}` | null, b?: `${RealmScope}` | null): number;
/** Fold scopes to the MOST permissive (ordered max). Empty folds to `own`. */
export declare function maxRealmScope(values: Array<`${RealmScope}` | null | undefined>): `${RealmScope}`;
/** Fold scopes to the MORE restrictive (ordered min) — used to CAP a grant. Empty folds to `own`. */
export declare function minRealmScope(values: Array<`${RealmScope}` | null | undefined>): `${RealmScope}`;
/**
 * Whether `scope` reaches the resource. The resource realm may be presented as a single
 * id, `null` (global), or an array of realm ids — the array form (a resource that spans
 * multiple realms) requires the scope to reach EVERY listed realm (unanimous, fail-closed),
 * so any app/entity can express its realm via one or many keys under the canonical contract.
 */
export declare function realmScopeMatches(scope: `${RealmScope}` | null | undefined, resourceRealmId: string | Array<string | null> | null | undefined, identityRealmId: string | null | undefined, identityRealmName?: string | null): boolean;
//# sourceMappingURL=helpers.d.ts.map