/**
 * Define a typed, deterministic role-to-permission resolver.
 *
 * This complements the database-backed `Rbac` facade for applications whose
 * role grants live in source control, or whose tenant membership is the
 * authorization subject rather than the authenticated user record itself.
 */
export declare function defineRolePermissions<const TRole extends string, const TPermission extends string>(grants: RolePermissionMap<TRole, TPermission>): RolePermissions<TRole, TPermission>;
export declare interface RolePermissions<TRole extends string, TPermission extends string> {
  roleCan: (role: TRole | null | undefined, permission: TPermission) => boolean
  can: (subject: { role: TRole } | null | undefined, permission: TPermission) => boolean
  canAny: (subject: { role: TRole } | null | undefined, permissions: readonly TPermission[]) => boolean
  canAll: (subject: { role: TRole } | null | undefined, permissions: readonly TPermission[]) => boolean
  forRole: (role: TRole | null | undefined) => readonly TPermission[]
}
export type RolePermissionMap<TRole extends string, TPermission extends string> = Record<TRole, readonly TPermission[]>;