import type { RoleClass } from "./types.js";
/** The three role classes a starter role may declare (RBAC drive §5 / D576). */
export declare const ROLE_CLASSES: readonly ["standard", "admin", "seat"];
export declare function validateDomainKey(domainKey: string, opts?: {
    allowReserved?: boolean;
}): void;
export declare function validatePermissionSegment(value: string, which: "resource" | "verb" | "qualifier"): void;
export declare function validateSemver(version: string): void;
/**
 * Final runtime fence (Layer 2 per § 5.2) — re-validate the assembled
 * permission key regardless of where it came from. Catches the case where
 * a caller hand-wrote a PermissionDef[] bypassing definePermissions.
 */
export declare function validatePermissionKey(key: string, opts?: {
    allowReserved?: boolean;
}): void;
/**
 * REQUIRED entitlement key validator (D655 / D649 § 3).
 *
 * Accepts the exact {@link SUBSTRATE_ENTITLEMENT} sentinel FIRST — it is a
 * reserved namespace, so it can never be a real module key and never needs to
 * survive the commerce-key shape check. Everything else must be a 1–2-segment
 * commerce module/add-on key.
 *
 * There is deliberately NO transitional acceptance of empty/undefined: the
 * compile error (typed callers) or this throw (hand-built `PermissionDef[]`) IS
 * the adoption checklist. An escape hatch would let an adoption PR go green
 * with the fill half-done, recreating the exact NULL drift D649 kills.
 */
export declare function validateEntitlementKey(value: string, permissionKey: string): void;
/**
 * Starter-role MACHINE IDENTITY validator (D654). Same slug grammar as a
 * permission segment (`^[a-z][a-z0-9_]*$`, ≤ 50) — no dots, no hyphens, no
 * uppercase — because this string is the whole identity and a dotted key
 * (`crm.customer_lifecycle_approver`) is precisely the historical shape being
 * retired.
 */
export declare function validateStarterRoleKey(roleKey: string): void;
/**
 * Starter-role DISPLAY NAME validator (D654).
 *
 * Two failure branches on purpose. A slug-shaped name gets a TARGETED error
 * naming the real mistake ("that belongs in `key`"); anything else gets the
 * generic Title-Case error with examples. 19/19 of the live slug violators hit
 * the targeted branch.
 */
export declare function validateStarterRoleDisplayName(name: string): void;
/**
 * No-wildcard authoring gate (NEW-BM-D7). Starter roles must enumerate concrete
 * permission keys — a wildcard (`crm.*`, or any key containing `*`) is rejected
 * at authoring AND publish time. Throws StarterRoleWildcardNotAllowed on the
 * first offending key.
 */
export declare function assertNoWildcardPermissionKeys(roleName: string, permissionKeys: readonly string[]): void;
/**
 * Validate + normalize a starter role's class + seat dimension (RBAC drive §5 /
 * §2.2). Enforces the iff-rule: `roleClass === 'seat'` REQUIRES a non-empty
 * `seatDimensionKey`; every other class MUST NOT carry one. Returns the resolved
 * pair (roleClass defaulted to `'standard'`). Throws InvalidStarterRoleClass.
 */
export declare function resolveStarterRoleClass(roleName: string, roleClass: string | undefined, seatDimensionKey: string | undefined): {
    roleClass: RoleClass;
    seatDimensionKey?: string;
};
/** Helper: is a string a reserved-namespace permission key? */
export declare function isReservedNamespace(domainKey: string): boolean;
/** Helper: is a string one of the reserved SUBSTRATE domain_keys (07-rbac
 *  § 5.5 / D513) — a publish envelope for a never-subscribable infra substrate
 *  service owning keys across multiple namespaces? */
export declare function isSubstrateDomainKey(domainKey: string): boolean;
/**
 * Validate a substrate publish's declared `ownedNamespaces` set (07-rbac
 * § 5.5.2 / D513). Each declared namespace must be a well-formed domain-key AND
 * must NOT be a §2 publish-forbidden reserved namespace — a substrate publisher
 * cannot "own" pii/audit/dsar/platform/system. Throws SubstrateNamespaceViolation
 * on any violation.
 */
export declare function validateOwnedNamespaces(ownedNamespaces: readonly string[]): void;
//# sourceMappingURL=validation.d.ts.map