import { z } from 'zod';
import { type InferProvider } from './capability-definition.js';
/**
 * Authentication-provider summary metadata. Drives the admin UI's
 * "Authentication Providers" page and the login screen's provider
 * picker (Google / Microsoft / SAML / etc. buttons next to the
 * username/password form).
 *
 * Keep the shape lean: the admin UI doesn't render runtime
 * credentials, only enough to identify the provider and its UX
 * affordances. Per-provider config still lives in the addon's own
 * settings panel.
 */
declare const AuthProviderInfoSchema: z.ZodObject<{
    addonId: z.ZodString;
    displayName: z.ZodString;
    kind: z.ZodEnum<{
        other: "other";
        local: "local";
        oidc: "oidc";
        saml: "saml";
        ldap: "ldap";
    }>;
    icon: z.ZodOptional<z.ZodString>;
    hasRedirectFlow: z.ZodBoolean;
    hasCredentialFlow: z.ZodBoolean;
    status: z.ZodOptional<z.ZodString>;
    enabled: z.ZodBoolean;
}, z.core.$strip>;
export type AuthProviderInfo = z.infer<typeof AuthProviderInfoSchema>;
/**
 * `authentication` — singleton facade over the `auth-provider`
 * collection. Consumed by:
 *   - Login page (enumerate provider buttons)
 *   - Admin UI Authentication page (list/configure/enable/disable)
 *
 * Mirrors the pattern of `backup` (singleton facade over the
 * `backup-destination` collection) — UI consumers don't need to know
 * about individual `auth-provider` providers; they call this and
 * receive a curated view.
 *
 * The actual login flow still goes through the `auth-provider`
 * collection (validateCredentials / getLoginUrl / handleCallback);
 * this cap only listing/orchestration.
 */
export declare const authenticationCapability: {
    readonly name: "authentication";
    readonly scope: "system";
    readonly mode: "singleton";
    readonly methods: {
        /** All registered auth providers, both enabled and disabled. */
        readonly listProviders: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodReadonly<z.ZodArray<z.ZodObject<{
            addonId: z.ZodString;
            displayName: z.ZodString;
            kind: z.ZodEnum<{
                other: "other";
                local: "local";
                oidc: "oidc";
                saml: "saml";
                ldap: "ldap";
            }>;
            icon: z.ZodOptional<z.ZodString>;
            hasRedirectFlow: z.ZodBoolean;
            hasCredentialFlow: z.ZodBoolean;
            status: z.ZodOptional<z.ZodString>;
            enabled: z.ZodBoolean;
        }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
        /**
         * Toggle a provider's enabled flag. Disabled providers stay
         * registered but aren't surfaced on the login page. The orchestrator
         * persists the state in `addon-settings` so it survives restarts.
         */
        readonly setProviderEnabled: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            addonId: z.ZodString;
            enabled: z.ZodBoolean;
        }, z.core.$strip>, z.ZodObject<{
            success: z.ZodLiteral<true>;
        }, z.core.$strip>, "mutation">;
    };
};
export type IAuthenticationProvider = InferProvider<typeof authenticationCapability>;
export { AuthProviderInfoSchema };
//# sourceMappingURL=authentication.cap.d.ts.map