import { ICmsSDK } from '../core/sdk.type';
import { IPortalAccess } from '../services/authz';
/**
 * Authz store — authorization domain state (permissions, roles) with the
 * canonical fetch-once cache.
 *
 * The call contract for every portal:
 *   - fetch on login success,
 *   - fetch on session restore (page refresh),
 *   - NEVER fetch before rendering a protected feature — read the cache.
 *
 * `loadPortalAccess()` implements that contract: it is a no-op once loaded
 * and deduplicates concurrent callers (middleware + components race on cold
 * boot). The cache is invalidated on explicit re-auth (`loginEpoch` bump in
 * the auth store — silent sliding token rotation does NOT invalidate) and
 * reset on logout, so a fresh login always re-resolves access.
 *
 * The endpoint (`GET /api/v1/authz/me/portals`) returns the caller's
 * effective grants only — there is no access flag on the wire. Consumers
 * gate their portal's access key themselves (e.g. `can('people:portal:access')`
 * in the route middleware). Consumers branch on `errorCode` for the
 * documented failures: `UNAUTHENTICATED` / `INVALID_TOKEN_AUDIENCE`
 * (session unusable for this portal) and a legacy 403
 * `PORTAL_ACCESS_DENIED` (still honoured for older backends).
 */
export declare const useAuthzStore: import('pinia').StoreDefinition<"cms-authz", Pick<{
    portalAccess: import('vue').Ref<{
        userId: number | null;
        permissions: string[];
        roles: string[];
    } | null, IPortalAccess | {
        userId: number | null;
        permissions: string[];
        roles: string[];
    } | null>;
    loaded: import('vue').Ref<boolean, boolean>;
    isLoading: import('vue').Ref<boolean, boolean>;
    errorCode: import('vue').Ref<string, string>;
    permissions: import('vue').ComputedRef<string[]>;
    roles: import('vue').ComputedRef<string[]>;
    isSessionInvalid: import('vue').ComputedRef<boolean>;
    isAccessDenied: import('vue').ComputedRef<boolean>;
    setSdk: (instance: ICmsSDK) => void;
    loadPortalAccess: (opts?: {
        force?: boolean;
    }) => Promise<void>;
    can: (permission: string) => boolean;
    hasRole: (role: string) => boolean;
    hasAnyPermission: (list: string[]) => boolean;
    hasAllPermissions: (list: string[]) => boolean;
}, "portalAccess" | "loaded" | "errorCode" | "isLoading">, Pick<{
    portalAccess: import('vue').Ref<{
        userId: number | null;
        permissions: string[];
        roles: string[];
    } | null, IPortalAccess | {
        userId: number | null;
        permissions: string[];
        roles: string[];
    } | null>;
    loaded: import('vue').Ref<boolean, boolean>;
    isLoading: import('vue').Ref<boolean, boolean>;
    errorCode: import('vue').Ref<string, string>;
    permissions: import('vue').ComputedRef<string[]>;
    roles: import('vue').ComputedRef<string[]>;
    isSessionInvalid: import('vue').ComputedRef<boolean>;
    isAccessDenied: import('vue').ComputedRef<boolean>;
    setSdk: (instance: ICmsSDK) => void;
    loadPortalAccess: (opts?: {
        force?: boolean;
    }) => Promise<void>;
    can: (permission: string) => boolean;
    hasRole: (role: string) => boolean;
    hasAnyPermission: (list: string[]) => boolean;
    hasAllPermissions: (list: string[]) => boolean;
}, "permissions" | "roles" | "isSessionInvalid" | "isAccessDenied">, Pick<{
    portalAccess: import('vue').Ref<{
        userId: number | null;
        permissions: string[];
        roles: string[];
    } | null, IPortalAccess | {
        userId: number | null;
        permissions: string[];
        roles: string[];
    } | null>;
    loaded: import('vue').Ref<boolean, boolean>;
    isLoading: import('vue').Ref<boolean, boolean>;
    errorCode: import('vue').Ref<string, string>;
    permissions: import('vue').ComputedRef<string[]>;
    roles: import('vue').ComputedRef<string[]>;
    isSessionInvalid: import('vue').ComputedRef<boolean>;
    isAccessDenied: import('vue').ComputedRef<boolean>;
    setSdk: (instance: ICmsSDK) => void;
    loadPortalAccess: (opts?: {
        force?: boolean;
    }) => Promise<void>;
    can: (permission: string) => boolean;
    hasRole: (role: string) => boolean;
    hasAnyPermission: (list: string[]) => boolean;
    hasAllPermissions: (list: string[]) => boolean;
}, "setSdk" | "loadPortalAccess" | "can" | "hasRole" | "hasAnyPermission" | "hasAllPermissions">>;
//# sourceMappingURL=authz.d.ts.map