import { z } from 'zod';
import { type InferProvider } from './capability-definition.js';
/**
 * `sso-bridge` — internal hub-only cap that lets SSO-style auth
 * providers (OIDC, SAML, magic-link, …) mint an HMAC-signed token
 * carrying the post-callback claims before redirecting back to
 * `/api/auth/sso/finish`.
 *
 * Without this, any client could craft a `?isAdmin=1` link to
 * `/sso/finish` and become admin. With it, the endpoint accepts ONLY
 * the signed token and rejects everything else.
 *
 * Backed by `AuthManager.{signSsoBridgeToken,verifySsoBridgeToken}` —
 * see `packages/core/src/auth/auth-manager.ts`. The provider is
 * registered at hub boot in `server/backend/src/main.ts`.
 */
declare const SsoBridgeClaimsSchema: z.ZodObject<{
    userId: z.ZodString;
    username: z.ZodString;
    isAdmin: z.ZodBoolean;
    provider: z.ZodString;
    email: z.ZodOptional<z.ZodString>;
    displayName: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
export declare const ssoBridgeCapability: {
    readonly name: "sso-bridge";
    readonly scope: "system";
    readonly mode: "singleton";
    readonly internal: true;
    readonly methods: {
        readonly signBridgeToken: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            claims: z.ZodObject<{
                userId: z.ZodString;
                username: z.ZodString;
                isAdmin: z.ZodBoolean;
                provider: z.ZodString;
                email: z.ZodOptional<z.ZodString>;
                displayName: z.ZodOptional<z.ZodString>;
            }, z.core.$strip>;
            ttlSec: z.ZodOptional<z.ZodNumber>;
        }, z.core.$strip>, z.ZodObject<{
            token: z.ZodString;
        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
        readonly verifyBridgeToken: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            token: z.ZodString;
        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
            userId: z.ZodString;
            username: z.ZodString;
            isAdmin: z.ZodBoolean;
            provider: z.ZodString;
            email: z.ZodOptional<z.ZodString>;
            displayName: z.ZodOptional<z.ZodString>;
        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
    };
};
export type ISsoBridgeProvider = InferProvider<typeof ssoBridgeCapability>;
export { SsoBridgeClaimsSchema };
//# sourceMappingURL=sso-bridge.cap.d.ts.map