/**
 * EVO-12 P2 (mode 3) — hono routes for the broker login. Thin wrapper over
 * `createBrokerLogin`: `/authorize` starts a login (302 → 39-auth) instead of
 * the single-tenant consent form; `/oidc/callback` completes it (exchange →
 * sub → per-user root) and hands off to the provider to issue the claude.ai
 * authorization code, then 302s back to claude.ai.
 *
 * `issueClaudeaiCode` is injected (the SingleTenantOAuthProvider's code issuance,
 * bound to the resolved user/root) → routes are testable via `app.request` with
 * a mock IdP, no provider/network.
 */
import { Hono } from "hono";
import type { BrokerLogin } from "./broker-login.js";
export interface BrokerRoutesDeps {
    readonly brokerLogin: BrokerLogin;
    /**
     * Issue the claude.ai authorization code for the original request, bound to
     * the authenticated user/root, and return the claude.ai redirect URL
     * (`<redirect_uri>?code=…&state=…`).
     */
    readonly issueClaudeaiCode: (claudeai: Record<string, string>, ctx: {
        sub: string;
        root: string;
    }) => string | Promise<string>;
    /**
     * Validate the claude.ai /authorize request BEFORE delegating to 39-auth. The
     * single-tenant flow is gated by the consent secret; the broker has none, so
     * an unvalidated `redirect_uri` would let an attacker craft
     * `/authorize?client_id=<real>&redirect_uri=https://evil&code_challenge=<theirs>`,
     * have the victim log in at 39-auth, and collect a code at their URL bound to
     * the victim's sub. This MUST reject an unregistered redirect_uri / bad PKCE
     * before the login starts. Returns ok, or an error rendered as 400.
     */
    readonly validateClaudeaiAuthorize?: (claudeai: Record<string, string>) => Promise<{
        ok: true;
    } | {
        ok: false;
        error: string;
        description: string;
    }>;
    /** Callback path registered at 39-auth. Default `/oidc/callback`. */
    readonly callbackPath?: string;
}
export declare function buildBrokerRoutes(deps: BrokerRoutesDeps): Hono;
//# sourceMappingURL=broker-routes.d.ts.map