/**
 * Linear-time `*` glob match (design/127 M6: NOT a RegExp — patterns may come from tenant-supplied
 * Settings layers; the classic two-pointer walk has zero ReDoS surface and the same semantics as CC's
 * anchored `^…$`+dotAll construction: every non-`*` char is literal, `*` spans anything incl. newlines).
 */
export declare function wildcardMatch(pattern: string, value: string): boolean;
/**
 * Does a namespaced RULE name cover `toolName`? — the tail branch of CC's rule matcher `VRp`
 * (:595780), which is UNCONDITIONAL there (its `globMatching` option gates only the whole-name glob
 * branch, so CC's allow lane — `mVo` :595803, which passes no options — matches MCP segments too).
 * Three covering forms, matching CC's three disjuncts (`<ns>` = any protocol-table prefix):
 *   · `<ns>__<peer>`           — every tool of that peer (rule tool segment absent);
 *   · `<ns>__<peer>__*`        — the same set, spelled with the star CC's own settings validator
 *                                recommends (`"MCP rules do not support patterns in parentheses …
 *                                use mcp__srv__*"`);
 *   · `<ns>__<peer>__get_*`    — a glob over the tool segment.
 * A LITERAL tool segment is deliberately NOT covered here: it is an exact tool name, and the exact
 * table already answers it — the same split CC makes with its leading `ruleName === toolName`.
 *
 * Rule and target must be in the SAME namespace, and peer segments compare EXACTLY (CC
 * `s.serverName === a.serverName`). A rule must therefore spell the peer the way the mint does; that
 * is the same string an operator reads off any mounted tool name, and inventing a fuzzier comparison
 * here would let one rule reach a peer — or a protocol — it does not name.
 */
export declare function namespacedRuleNameCovers(ruleName: string, toolName: string): boolean;
/** True ⇔ this rule name is a namespaced name whose reach is a SET of tools rather than one exact tool
 *  — i.e. the shapes {@link namespacedRuleNameCovers} answers and an exact name table cannot. Every
 *  lane that keys rules by exact tool name needs this to know which entries it must NOT key that way. */
export declare function isNamespacedCoveringRuleName(name: string): boolean;