import { type ChannelCredentials, type Interceptor } from "@grpc/grpc-js";
import type { PermissionDef, PublishCatalogResponse, StarterRoleDef } from "./types.js";
export interface RoleCatalogClientOptions {
    /** Target host:port for the RoleCatalogService. e.g. `tenant.svc.local:50051`. */
    url: string;
    /** Optional channel credentials. Defaults to insecure (test stack); production
     *  callers should pass TLS creds. */
    channelCredentials?: ChannelCredentials;
    /** Optional gRPC client interceptors — typically the S2S auth interceptor
     *  produced by @nodii/grpc-auth/client.createClientAuthInterceptor(). */
    interceptors?: Interceptor[];
    /** Optional deadline (ms from now) per RPC. Default 30s. */
    deadlineMs?: number;
}
/** Every field of {@link PublishCatalogArgs} EXCEPT the domain key. Exported so
 *  consumers that need a plain extendable interface still have one; kept for
 *  source compatibility now that {@link PublishCatalogArgs} is a plain
 *  interface rather than an intersection with a union. */
export interface PublishCatalogArgsBase {
    catalogVersion: string;
    serviceOwner: string;
    serviceVersion: string;
    permissions: readonly PermissionDef[];
    starterRoles: readonly StarterRoleDef[];
    bypassReservedNamespaceCheck?: boolean;
}
/** Args for {@link RoleCatalogClient.publishCatalog}.
 *
 *  0.11.0 deleted the 0.7.0 `moduleKey` compat arm outright (see CHANGELOG):
 *  `domainKey` is the only spelling. Every live publish call site in the fleet
 *  already passes it. */
export interface PublishCatalogArgs extends PublishCatalogArgsBase {
    /** RBAC permission namespace — the first segment of every permission key. */
    domainKey: string;
}
/** Lightweight wire-shape produced by the @grpc/proto-loader codec. */
interface WirePermission {
    key: string;
    description: string;
    is_critical: boolean;
    deprecated_in_version: string;
    entitlement_key: string;
    assignment_policy: string;
    /** D633 § 3 / D656 — PermissionDef field 7. Only ever ADDS marking. */
    is_cross_tenant: boolean;
}
interface WireStarterRole {
    /** D654 — StarterRoleDef field 8. The role's machine identity. */
    key: string;
    /** DISPLAY-ONLY Title Case since 0.11.0 (D654). */
    name: string;
    description: string;
    permission_keys: string[];
    is_default_for_new_tenants: boolean;
    is_recommended: boolean;
    role_class: string;
    seat_dimension_key: string;
}
interface WirePublishRequest {
    domain_key: string;
    catalog_version: string;
    service_owner: string;
    service_version: string;
    permissions: WirePermission[];
    starter_roles: WireStarterRole[];
    bypass_reserved_namespace_check: boolean;
}
/** Toggleable for tests. */
export declare function buildWireRequest(args: PublishCatalogArgs): WirePublishRequest;
export declare class RoleCatalogClient {
    private readonly client;
    private readonly deadlineMs;
    constructor(opts: RoleCatalogClientOptions);
    publishCatalog(args: PublishCatalogArgs): Promise<PublishCatalogResponse>;
    close(): void;
}
export {};
//# sourceMappingURL=client.d.ts.map