/**
 * Authz domain DTOs (engine RBAC surface).
 *
 * Field names are camelCase per the SDK public-surface convention; the
 * backend wire shape arrives camelCase too (`userId` — the CMS casing
 * middleware rewrites response bodies). No tokens travel here — the
 * access check is a pure read.
 */
export interface IPortalAccess {
    /** Caller id resolved by the engine (null when absent on the wire). */
    userId: number | null;
    /**
     * Effective permission codes, e.g. `people:catalog:view`.
     * `['*']` means wildcard (grant-all) — consumers should honour it.
     */
    permissions: string[];
    /** Effective portal roles, e.g. `people_operator`. */
    roles: string[];
}
//# sourceMappingURL=authz.type.d.ts.map