import type { OidcPermissionSetClaim } from '@owlmeans/oidc';
/**
 * Shape-validates a `permissions` token claim into permission sets.
 * An empty array is a valid claim for an authenticated person with no grants;
 * undefined is reserved for missing or malformed claims, which keeps the
 * claims-based gate path inert outside the integrated IAM mode.
 *
 * A set may be bound to an organization (`entitySlug`). The claim keeps that binding: what a
 * token may carry of it is `actingPermissionSets`' decision, not this one's.
 */
export declare const extractPermissionSets: (claim: unknown) => OidcPermissionSetClaim[] | undefined;
//# sourceMappingURL=permissions.d.ts.map