/**
 * Auth configuration, resolved once at startup.
 *
 * **Email and password is the primary sign-in method**, and OAuth is an optional addition. That is
 * a reversal: password sign-in began as a dev-only convenience that `resolveAuthConfig` refused to
 * boot with outside development, on the reasoning that a password backdoor which is meant to be
 * off and quietly is not is exactly the bug that survives to production.
 *
 * The reasoning was right about a *backdoor* and wrong about a *front door*. A deliberate,
 * documented, rate-limited password provider is not a backdoor — the thing that made it dangerous
 * was being a hidden second way in, not the passwords. So it is now the visible first way in, and
 * the guard that remains is the one that still means something: a deployment must have some way to
 * sign in, and `TAPROOT_PASSWORD_AUTH=0` with no OAuth provider configured is a locked building.
 *
 * Registering an OAuth app is real setup a fresh clone cannot do, which is the other half of why
 * this is the default: it is what keeps `npm run dev` working with nothing but `npm install`.
 */
export interface OAuthProviderConfig {
    clientId: string;
    clientSecret: string;
    /** Entra only. */
    tenant?: string;
}
export interface AuthConfig {
    /** Absolute origin used to build OAuth redirect URIs, e.g. `https://cms.example.edu`. */
    origin: string;
    /** Whether email/password sign-in is available. On unless explicitly turned off. */
    passwordAuthEnabled: boolean;
    /** `Secure` is dropped for local HTTP, where the browser would otherwise discard the cookie. */
    secureCookies: boolean;
    providers: {
        google?: OAuthProviderConfig;
        github?: OAuthProviderConfig;
        microsoft?: OAuthProviderConfig;
    };
}
export interface AuthEnv {
    NODE_ENV?: string;
    /** `0` turns email/password sign-in off, for a deployment that wants OAuth only. */
    TAPROOT_PASSWORD_AUTH?: string;
    /**
     * The former dev-only switch.
     *
     * Read only to fail loudly: password sign-in is now on by default, so an environment still
     * setting this is configured against a model that no longer exists, and silently ignoring it
     * would leave someone believing they had restricted something.
     */
    TAPROOT_DEV_AUTH?: string;
    TAPROOT_ORIGIN?: string;
    GOOGLE_CLIENT_ID?: string;
    GOOGLE_CLIENT_SECRET?: string;
    GITHUB_CLIENT_ID?: string;
    GITHUB_CLIENT_SECRET?: string;
    MICROSOFT_CLIENT_ID?: string;
    MICROSOFT_CLIENT_SECRET?: string;
    MICROSOFT_TENANT?: string;
}
export declare class AuthConfigError extends Error {
    name: string;
}
export declare function resolveAuthConfig(env: AuthEnv): AuthConfig;