/**
 * Authz backend endpoint (engine RBAC surface).
 *
 *   GET /api/v1/authz/me/portals — the caller's effective grants:
 *   `{ userId, permissions[], roles[] }` (200 for any authenticated
 *   caller — there is no per-portal `has_access` flag or deny status on
 *   the wire). Portal-level access is a PERMISSION verdict: consumers
 *   gate their own access key (e.g. `people:portal:access`) against the
 *   returned grants via `useAuthzStore.can`.
 *
 * Error contract:
 *   401 UNAUTHENTICATED        — token invalid/expired
 *   401 INVALID_TOKEN_AUDIENCE — token valid but minted for another portal
 *
 * (Legacy 403 `PORTAL_ACCESS_DENIED` from the old
 * `/authz/me/portals/{portal}` route is still honoured by the store for
 * back-compat with backends that predate this contract.)
 */
export declare const AUTHZ_ENDPOINT: {
    readonly portalAccess: () => string;
};
/**
 * Client→proxy route paths for authz flows (mirror of `AUTH_PROXY_PATH`).
 *
 * When the Nuxt module is in use the check routes through the app-origin
 * server proxy (`/api/cms/portal-access`) so the httpOnly token cookie is
 * forwarded server-side — the client never needs the raw token.
 */
export declare const AUTHZ_PROXY_PATH: {
    readonly PORTAL_ACCESS: "/portal-access";
};
//# sourceMappingURL=authz.constant.d.ts.map