import type { AdmissionRules } from '../../policy/types.ts';
/**
 * Refuse a document whose rules cannot behave as written.
 *
 * Both checks name a rule that is dead on arrival, which is worse than a
 * missing rule because it reads as a guard. Raised where the document is
 * compiled, so a deployment learns at startup rather than the first time
 * an agent types the line the operator thought was covered.
 */
export declare function checkRules(rules: AdmissionRules | null): void;
/**
 * Refuse a rule naming a verb the CLI it names does not have.
 *
 * Deferred to `createSession` rather than done beside the other two,
 * because a CLI is registered on the workspace after it is built: at
 * compile time `git push` is just two words, and only once `git` is
 * installed is there a program tree to check the verb against. A head
 * word no installed CLI claims is left alone, since it may be a command,
 * a function, or a CLI registered later.
 */
export declare function checkCliVerbs(rules: AdmissionRules | null, verbs: ReadonlyMap<string, ReadonlySet<string>>): void;
//# sourceMappingURL=validate.d.ts.map