import type { DefinedPermissionMap, PermissionDefInput, StarterRoleDef } from "./types.js";
/** Compile-time-safe permission builder.
 *
 * - Validates domain_key shape + reserved namespace (unless allowReserved set).
 * - Validates each resource/verb/qualifier per § 5.2.
 * - Constructs the canonical permission key `<domain>.<resource>.<verb>[.<qualifier>]`.
 * - Returns a const map with typed `.key` template-literal narrowing.
 *
 * Typos in resource/verb become compile errors on consumers who type their
 * downstream requirePermission() signatures with `keyof typeof CATALOG`.
 */
export declare function definePermissions<K extends string, const T extends Record<string, PermissionDefInput>>(domainKey: K, defs: T, opts?: {
    allowReserved?: boolean;
}): DefinedPermissionMap<K, T>;
/** Define starter roles with cross-validation against a permission catalog.
 *
 * - Validates each role's permissionKeys exist in the catalog and carry this
 *   catalog's domain_key as their first segment.
 * - Rejects WILDCARD permission keys outright (NEW-BM-D7) — starter roles must
 *   enumerate concrete keys. (This doc previously described the pre-gate
 *   "wildcard prefix must match" behaviour, which #544 replaced.)
 *
 * Per spec § 5.1 — pass the result of definePermissions(...) as
 * `catalog` so cross-checks happen at definition time.
 */
export declare function defineStarterRoles<K extends string, TMap extends DefinedPermissionMap<K, Record<string, PermissionDefInput>>>(domainKey: K, catalog: TMap, roles: readonly StarterRoleDef[], opts?: {
    allowReserved?: boolean;
}): StarterRoleDef[];
/** Helper: check if a domainKey is reserved (used by publish path for the
 *  bypass-flag audit emission). */
export declare function isReservedDomain(domainKey: string): boolean;
//# sourceMappingURL=define.d.ts.map