/**
 * Central-login OAuth constants (FEAT-014 portal integration contract).
 *
 * The portal BFF owns state + PKCE; the browser only ever sees the
 * authorize redirect and the code/state echo on the callback. Secrets and
 * verifiers stay server-side.
 */
export declare const OAUTH_PROXY_PATH: {
    /** GET — starts the flow (302 to the CMS authorize URL). Must match the
     *  route the Nuxt module registers in `nuxt.ts` (SERVER_HANDLERS). */
    readonly START: "/api/cms/oauth/start";
    /** GET — CMS code callback (state check + code exchange). Must match the
     *  route the Nuxt module registers in `nuxt.ts` (SERVER_HANDLERS). */
    readonly CALLBACK: "/api/cms/oauth/callback";
};
/** Browser-correlation cookie holding the local transaction id. */
export declare const OAUTH_TXN_COOKIE = "cms_oauth_txn";
/** Transaction TTL — must cover the whole login round-trip. */
export declare const OAUTH_TXN_TTL_MS: number;
/** Prune threshold — keep the in-memory map bounded. */
export declare const OAUTH_TXN_MAX_ENTRIES = 1000;
/** Token endpoint grant used for the code exchange. */
export declare const OAUTH_GRANT_AUTHORIZATION_CODE = "authorization_code";
/** PKCE method required by the CMS (S256, 43-char challenge, no padding). */
export declare const OAUTH_PKCE_METHOD = "S256";
//# sourceMappingURL=oauth.constant.d.ts.map