/**
 * Auth backend endpoints.
 *
 * The CMS backend exposes exactly three auth endpoints:
 *   - LOGIN    (POST /api/auth/login)   — confirmed against the real backend
 *   - LOGOUT   (POST /api/auth/logout)  — confirmed (real backend logout is POST)
 *   - REFRESH  (POST /api/oauth/token)  — confirmed — OAuth token endpoint;
 *                                         grant_type=refresh_token
 *
 * Path params are appended at call sites.
 */
export declare const AUTH_ENDPOINT: {
    readonly LOGIN: "/api/auth/login";
    readonly LOGOUT: "/api/auth/logout";
    readonly REFRESH: "/api/oauth/token";
    /** User registry (GET /api/auth/users) — list of the CMS auth users. */
    readonly USERS: "/api/auth/users";
    readonly ME: "/api/auth/me";
    /** "Login with CBS" — init (PKCE verifier + state stay server-side). */
    readonly CBS_START: "/api/v1/auth/oauth/cbs/start";
    /** "Login with CBS" — complete (exchange code → CMS session JWT). */
    readonly CBS_CALLBACK: "/api/v1/auth/oauth/cbs/callback";
    /** IdP SSO — init (`GET /api/auth/{provider}/login?redirect_uri=…`). */
    readonly idpLogin: (provider: string) => string;
    /** IdP SSO — callback (`GET /api/auth/{provider}/callback?code&state&redirect_uri`). */
    readonly idpCallback: (provider: string) => string;
    /** IdP SSO — link an already-authenticated user to the provider (needs Bearer). */
    readonly idpLink: (provider: string) => string;
    /** IdP SSO — unlink the provider from the current user (needs Bearer). */
    readonly idpUnlink: (provider: string) => string;
    /** IdP SSO — link-start (`GET /api/auth/idp/{provider}/link/start`). The
     *  engine returns `{authorization_url, state}` for the App-link round-trip
     *  (PIP-006). Distinct from `idpLogin` — user is already authenticated
     *  and the flow only attaches an external identity. */
    readonly idpLinkStart: (provider: string) => string;
    /** IdP SSO — link-callback (`POST /api/auth/idp/{provider}/link/callback`,
     *  body `{state, code}`). Returns `{status, login}`. */
    readonly idpLinkCallback: (provider: string) => string;
    /** Current session profile + linked identities (`GET /api/auth/me`). */
    readonly me: "/api/auth/me";
};
/**
 * Client→proxy route paths for token-lifecycle flows.
 *
 * When the Nuxt module is in use, login/logout/token route through the
 * app-origin server proxies (`/api/cms/*`) so the httpOnly cookies are
 * set/cleared/rotated atomically. These are the paths the auth service calls
 * on its `routeApi` (whose baseURL is `/api/cms`).
 */
export declare const AUTH_PROXY_PATH: {
    readonly LOGIN: "/login";
    readonly LOGOUT: "/logout";
    readonly REFRESH: "/refresh";
    readonly CBS_START: "/cbs-start";
    readonly CBS_CALLBACK: "/cbs-callback";
    /** IdP SSO — init (query: `provider`, `redirect_uri`). */
    readonly IDP_LOGIN: "/idp-login";
    /** IdP SSO — callback (query: `provider`, `code`, `state`, `redirect_uri`). */
    readonly IDP_CALLBACK: "/idp-callback";
    /** IdP SSO — link (body: `{ provider }`; forwards the token cookie as Bearer). */
    readonly IDP_LINK: "/idp-link";
    /** IdP SSO — unlink (query: `provider`; forwards the token cookie as Bearer). */
    readonly IDP_UNLINK: "/idp-unlink";
    /** IdP SSO — link-start (query: `provider`; no body). */
    readonly IDP_LINK_START: "/idp-link-start";
    /** IdP SSO — link-callback (body: `{provider, state, code}`; forwards the
     *  token cookie as Bearer). */
    readonly IDP_LINK_CALLBACK: "/idp-link-callback";
    /** Current session profile (`GET /api/auth/me`; forwards the token cookie
     *  as Bearer so SSR hydrate works without the in-memory token mirror). */
    readonly IDP_ME: "/idp-me";
};
//# sourceMappingURL=auth.constant.d.ts.map