export declare class RoleCatalogError extends Error {
    readonly name: string;
}
export declare class InvalidDomainKey extends RoleCatalogError {
    readonly name = "InvalidDomainKey";
}
/** Which segment of a permission key failed validation.
 *
 *  ⚠️ 0.7.0 renamed the first-segment discriminant `"module_key"` ->
 *  `"domain_key"`. The old literal is RETAINED in the union (deprecated, never
 *  produced) so a consumer's existing `if (e.which === "module_key")` /
 *  exhaustive switch keeps COMPILING — but it will no longer MATCH. Comparisons
 *  against the old literal must be migrated by hand; nothing will flag them. */
export type PermissionSegmentDiscriminant = "domain_key"
/** @deprecated 0.7.0 renamed this to `"domain_key"`. Never produced. Removed in 1.0.0. */
 | "module_key" | "resource" | "verb" | "qualifier";
export declare class InvalidPermissionSegment extends RoleCatalogError {
    readonly which: PermissionSegmentDiscriminant;
    readonly value: string;
    readonly name = "InvalidPermissionSegment";
    constructor(which: PermissionSegmentDiscriminant, value: string, message: string);
}
export declare class InvalidSegmentCount extends RoleCatalogError {
    readonly name = "InvalidSegmentCount";
}
export declare class ReservedNamespaceViolation extends RoleCatalogError {
    readonly name = "ReservedNamespaceViolation";
}
/** A substrate multi-namespace publish (domainKey ∈ SUBSTRATE_DOMAIN_KEYS)
 *  either declared a §2-reserved namespace as "owned" or carried a permission
 *  key whose first-segment ∉ the declared ownedNamespaces set. See 07-rbac
 *  § 5.5.2 + D513. */
export declare class SubstrateNamespaceViolation extends RoleCatalogError {
    readonly name = "SubstrateNamespaceViolation";
}
export declare class InvalidCatalogVersion extends RoleCatalogError {
    readonly name = "InvalidCatalogVersion";
}
export declare class CatalogTooLarge extends RoleCatalogError {
    readonly name = "CatalogTooLarge";
}
export declare class DuplicatePermissionKey extends RoleCatalogError {
    readonly name = "DuplicatePermissionKey";
}
export declare class StarterRoleReferencesUnknownPermission extends RoleCatalogError {
    readonly name = "StarterRoleReferencesUnknownPermission";
}
/** AUTHORING-layer (`defineStarterRoles`) namespace mismatch: a starter role
 *  referenced a permission key whose first segment is not the catalog's own
 *  `domainKey`. The name is a historical artefact of the pre-#544 "wildcard
 *  prefix must match" gate; the check it guards today is a plain namespace
 *  check. Kept verbatim so existing `catch (e) { e instanceof
 *  StarterRoleWildcardMismatch }` blocks around `defineStarterRoles` are
 *  untouched. The PUBLISH-layer equivalent is
 *  {@link StarterRoleNamespaceViolation}. */
export declare class StarterRoleWildcardMismatch extends RoleCatalogError {
    readonly name = "StarterRoleWildcardMismatch";
}
/** PUBLISH-layer (Layer 2, `publishCatalogOnce`) namespace fence for starter
 *  roles — drift `55b2e60f`.
 *
 *  Before 0.14.0 the namespace check on a starter role's `permissionKeys` was
 *  AUTHORING-ONLY: `defineStarterRoles` enforced `firstSegment === domainKey`,
 *  but `publishCatalogOnce` re-validated key shape, display name, duplicates,
 *  wildcards and roleClass and NEVER the namespace. A hand-built
 *  `StarterRoleDef[]` that skipped the authoring helper therefore sailed
 *  through with foreign keys and reported `status = published`; tenant-service
 *  persisted them into `predefined_roles` (its `filterLiveCatalogKeys` is not
 *  domain-scoped) and they propagated to every tenant clone via D611 rule-5.
 *  i.e. ANY module could grant ANY other module's permissions.
 *
 *  The fence re-asserts 07-rbac-doctrine § 4 ("permissions FROM THE CATALOG
 *  this role grants") at publish time. The § 5.5.2 / D513 relaxation still
 *  applies — and ONLY — to a reserved substrate `domainKey` publishing with a
 *  declared `ownedNamespaces` set, where a violation surfaces as
 *  {@link SubstrateNamespaceViolation} exactly as it does for permission keys.
 *
 *  Deliberately NOT a subclass of {@link StarterRoleWildcardMismatch}: this
 *  fires at a layer that previously had no check at all, so there is no
 *  existing catch block to stay compatible with, and inheriting a misleading
 *  name to buy compatibility nobody needs is a worse trade than a new one. */
export declare class StarterRoleNamespaceViolation extends RoleCatalogError {
    readonly name = "StarterRoleNamespaceViolation";
}
/** A starter role referenced a WILDCARD permission key (e.g. `crm.*`). The
 *  no-wildcard authoring gate (NEW-BM-D7) rejects wildcards outright — starter
 *  roles must enumerate concrete permission keys so publish/clone semantics are
 *  explicit and auditable. Distinct from StarterRoleWildcardMismatch (which was
 *  the pre-gate "wildcard prefix must match the module" check). */
export declare class StarterRoleWildcardNotAllowed extends RoleCatalogError {
    readonly name = "StarterRoleWildcardNotAllowed";
}
/** A starter role declared an invalid `roleClass`, or violated the seat rule:
 *  `roleClass === 'seat'` REQUIRES a non-empty `seatDimensionKey`, and any other
 *  class MUST NOT carry one (RBAC drive §5 / §2.2). */
export declare class InvalidStarterRoleClass extends RoleCatalogError {
    readonly name = "InvalidStarterRoleClass";
}
/** A permission declared no `entitlementKey`, an empty one, or one that is
 *  neither a 1–2-segment commerce module/add-on key nor the exact
 *  `SUBSTRATE_ENTITLEMENT` sentinel (D655 / D649 § 3). */
export declare class InvalidEntitlementKey extends RoleCatalogError {
    readonly name = "InvalidEntitlementKey";
}
/** A starter role declared no `key`, or one outside the slug shape
 *  `^[a-z][a-z0-9_]*$` / the 50-char cap (D654). */
export declare class InvalidStarterRoleKey extends RoleCatalogError {
    readonly name = "InvalidStarterRoleKey";
}
/** A starter role's `name` is not display-only Title Case (D654) — either it
 *  looks like a machine slug/dotted identifier (the targeted branch: put the
 *  slug in `key`) or it simply fails the Title-Case shape. */
export declare class InvalidStarterRoleName extends RoleCatalogError {
    readonly name = "InvalidStarterRoleName";
}
/** Two starter roles in one catalog declared the same `key`. Since 0.11.0 the
 *  key is the ONLY identity axis (D654), so a duplicate is an outright
 *  collision, not a near-miss. */
export declare class DuplicateStarterRoleKey extends RoleCatalogError {
    readonly name = "DuplicateStarterRoleKey";
}
/** The peer answered `accepted: true` AND returned a non-empty
 *  `namespace_validation_errors` (wire field 21) — i.e. it silently dropped
 *  some keys for grammar/namespace violations (D657).
 *
 *  Before 0.11.0 nothing decoded field 21, so this read as a clean success
 *  while the service's permission keys did not exist server-side — the
 *  documented root cause of a four-week live 403. It is a FAILURE now, carrying
 *  the peer's reasons, routed through the normal `onPublishFailure` policy. */
export declare class CatalogPublishNamespaceRejected extends RoleCatalogError {
    readonly reasons: readonly string[];
    readonly name = "CatalogPublishNamespaceRejected";
    constructor(message: string, reasons: readonly string[]);
}
/** defineRoleCatalogConsumer received a malformed spec (D581). Mirrors the
 *  fail-loud shape of @nodii/replica-consumer's InvalidReplicaSpec. */
export declare class InvalidRoleCatalogConsumerSpec extends RoleCatalogError {
    readonly name = "InvalidRoleCatalogConsumerSpec";
}
export declare class CatalogPublishFailedPrecondition extends RoleCatalogError {
    readonly name = "CatalogPublishFailedPrecondition";
}
export declare class CatalogPublishTimedOut extends RoleCatalogError {
    readonly attempts: number;
    readonly lastError?: Error | undefined;
    readonly name = "CatalogPublishTimedOut";
    constructor(message: string, attempts: number, lastError?: Error | undefined);
}
export declare class CatalogPublishUnavailable extends RoleCatalogError {
    readonly name = "CatalogPublishUnavailable";
}
//# sourceMappingURL=errors.d.ts.map