import type { IdType } from '../../../index.js';
import type { TNullable } from '@venizia/ignis-helpers/common';
import type { TAuthorizationAction } from '../common/constants/index.js';
/** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
export declare class AuthorizationPermissionBuilder {
    /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */
    static readonly RESOURCE_NODE_METHOD = "*";
    /** Standard repository method → base action. Unlisted methods (custom ops, aggregates) resolve to `execute`. */
    static readonly METHOD_ACTIONS: Readonly<Record<string, TAuthorizationAction>>;
    /** The CRUD methods {@link crud} generates by default. */
    static readonly DEFAULT_CRUD_METHODS: ReadonlyArray<string>;
    /** Base action for a method: a known CRUD method maps to read/create/update/delete; anything else → `execute`. */
    static actionForMethod(method: string): TAuthorizationAction;
    /** One operation-level permission, `code = <subject>.<method>`. `action` defaults to {@link actionForMethod}. */
    static operation<TName>(opts: {
        subject: string;
        method: string;
        scope: string;
        name: TName;
        description?: TNullable<TName>;
        action?: TAuthorizationAction;
        parentId?: TNullable<IdType>;
    }): {
        code: string;
        subject: string;
        method: string;
        action: TAuthorizationAction;
        scope: string;
        description: NonNullable<TName> | null;
        parentId: IdType | null;
        name: TName;
    };
    /** A coarse resource node used as a grant target: `code` is the bare name, `method` the {@link RESOURCE_NODE_METHOD} sentinel, `action` defaults to `manage` (grants carry their own action). */
    static resourceNode<TName>(opts: {
        code: string;
        subject?: string;
        scope: string;
        name: TName;
        description?: TNullable<TName>;
        action?: TAuthorizationAction;
        parentId?: TNullable<IdType>;
    }): {
        code: string;
        subject: string;
        method: string;
        action: TAuthorizationAction;
        scope: string;
        description: NonNullable<TName> | null;
        parentId: IdType | null;
        name: TName;
    };
    /** The CRUD permission set for a subject. `name` (and optional `description`) are per-method formatters, so the app supplies its own labels/i18n; the framework only owns the method-to-action map and the code shape. */
    static crud<TName>(opts: {
        subject: string;
        scope: string;
        name: (ctx: {
            subject: string;
            method: string;
            action: TAuthorizationAction;
        }) => TName;
        description?: (ctx: {
            subject: string;
            method: string;
            action: TAuthorizationAction;
        }) => TNullable<TName>;
        methods?: ReadonlyArray<string>;
    }): {
        code: string;
        subject: string;
        method: string;
        action: TAuthorizationAction;
        scope: string;
        description: NonNullable<TName> | null;
        parentId: IdType | null;
        name: TName;
    }[];
    /** g4 resource matcher (r.obj vs p.obj): derives standard edges (endpoint ⊂ subject ⊂ `*`) from the dotted code {@link operation} produces, while non-standard nesting stays stored g4 edges served by `ResourceRoleManager`. Registered via `enforcer.addFunction` - must stay static. */
    static objectMatch(requested: string, granted: string): boolean;
}
//# sourceMappingURL=permission.builder.d.ts.map