/**
 * Auth domain DTOs.
 *
 * Field names are camelCase to align with the CMS backend contract and the
 * project naming convention for all public SDK data shapes.
 *
 * The access token is NOT part of these DTOs — it travels in the response
 * header and is captured by the `createApi` `onResponse` hook into
 * `TokenManager` (single source of truth).
 */
export interface IAuthUser {
    id: number;
    /** `users.uuid` — the People pack identity ref (registry §3.19). */
    uuid?: string;
    email: string;
    name?: string;
    firstName?: string;
    lastName?: string;
    phone?: string;
    country?: string;
    state?: string;
    allowRoutes?: string[];
    kycId?: number;
    clientId?: number;
}
export interface IEmployee {
    id: number;
    email?: string;
    name?: string;
}
/** Response of login — a subset session profile. */
export interface IAuthSessionResponse {
    user?: IAuthUser;
    employee?: IEmployee;
}
export interface ILoginPayload {
    email: string;
    password: string;
    /**
     * Portal/OAuth client identifier (e.g. `people-hub`) — accepted in the
     * login body as camelCase. The Nuxt proxy injects the module-configured
     * client id (`cmsSdk.clientId` → `runtimeConfig.public.*`) when omitted,
     * so consumers only pass this to override the default.
     */
    clientId?: string;
}
/**
 * Row of `GET /api/auth/users` — the CMS user registry. The backend may
 * return any subset of label fields; every field except `id` is optional.
 */
export interface ICmsUser {
    id: number;
    /** `users.uuid` — the People pack identity ref (registry §3.19:
     * `subject_ref`/`requester_ref` = users.uuid). Optional until every
     * engine deployment projects it. */
    uuid?: string;
    email?: string;
    name?: string;
    firstName?: string;
    lastName?: string;
    username?: string;
    fullName?: string;
    phone?: string;
    clientId?: number;
}
/** Query for `GET /api/auth/users`. */
export interface IUsersQuery {
    page?: number;
    perPage?: number;
    /** Free-text search across the user label fields (backend-defined). */
    search?: string;
}
/** Row of `linkedIdentities[]` from `GET /api/auth/me`. */
export interface ILinkedIdentity {
    /** Provider id (e.g. `github`). */
    provider: string;
    /** User login on the provider (e.g. `DongNg64`). */
    login: string;
    /** ISO-8601 link timestamp. */
    linkedAt: string;
}
/**
 * `GET /api/auth/me` response — flat user profile with `linkedIdentities`
 * nested in. Distinct from `IAuthSessionResponse` (which wraps
 * `{user, employee}` and is used by login flows). Extends `IAuthUser` so the
 * SDK can opportunistically refresh the auth store on hydrate without a
 * separate `login()` round-trip. `email` is required by `IAuthUser` but the
 * portal never relies on a missing email — the `_camelMe` mapper always
 * assigns a string (empty when absent) so the contract holds.
 */
export interface IMeResponse extends Omit<IAuthUser, 'email'> {
    email: string;
    /** Whether the email is verified (engine-projected; optional). */
    emailVerified?: boolean;
    /** Lifecycle state (e.g. `active`) — backend-defined. */
    state?: string;
    /** Account creation timestamp — ISO-8601. */
    createdAt?: string;
    /** External identities linked to this user — see PIP-006. */
    linkedIdentities: ILinkedIdentity[];
}
/** Response of `POST /api/auth/idp/{provider}/link/callback` (PIP-006). */
export interface IIdpLinkCallbackResponse {
    status: 'connected';
    /** Provider-side login (e.g. `DongNg64`). */
    login: string;
    /** Provider id (echoed by the backend; the SDK call arg is the source of truth). */
    provider?: string;
}
//# sourceMappingURL=auth.type.d.ts.map