import { $Fetch } from 'ofetch';
import { IPortalAccess } from './authz.type';
export type { IPortalAccess } from './authz.type';
export interface IAuthzServiceOptions {
    /** The CMS `$Fetch` instance (one of `sdk.apis`). */
    api: $Fetch;
    /**
     * Optional `$Fetch` pointed at the app-origin `/api/cms` proxy (Nuxt
     * module). When set, the portal-access check routes through
     * `/api/cms/portal-access` so the httpOnly token cookie is forwarded
     * server-side and the raw token never reaches the client. When omitted,
     * the backend is called directly via `api` (Bearer attached by the
     * transport's TokenManager).
     */
    routeApi?: $Fetch;
    /** Lazy flag — when true, the service returns fake data. */
    mock: () => boolean;
}
export interface IAuthzService {
    /**
     * Resolve the caller's effective grants (`GET /api/v1/authz/me/portals`).
     * Consumers decide access by checking their portal's gate key against
     * `permissions` (e.g. via `useAuthzStore.can('people:portal:access')`).
     *
     * Throws on the documented error statuses so callers can branch:
     *   401 `UNAUTHENTICATED` / `INVALID_TOKEN_AUDIENCE`
     *   (codes survive in the error payload's `data` via the proxy's
     *   `authBackendError` / `extractAuthError`).
     */
    portalAccess(): Promise<IPortalAccess>;
}
/**
 * Authz domain service. Mirrors the engine RBAC surface: the caller's
 * effective permissions and roles.
 *
 * The result is cheap to refetch and MUST be re-resolved on login and on
 * session restore (page refresh) — caching across sessions is deliberately
 * left to the consumer (see `useAuthzStore` for the canonical fetch-once
 * cache with login/logout invalidation).
 */
export declare function createAuthzService(opts: IAuthzServiceOptions): IAuthzService;
//# sourceMappingURL=index.d.ts.map