import { GcpOidc } from '@webpieces/gcp-identity';
/**
 * DefaultOidcVerifier - the framework's built-in Google OIDC verifier, injected into
 * {@link AuthFilter} and run directly whenever no app {@link OidcHook} is bound. It is what makes
 * OIDC "just work" with ZERO wiring: http-routing depends on @webpieces/gcp-identity ON PURPOSE so a
 * server that binds nothing still verifies service-to-service OIDC.
 *
 * `verify` honors the endpoint's `@AuthOidc(...callers)` contract exactly: EMPTY (a bare `@AuthOidc()`)
 * = TRUST THE EDGE — verify the token is genuinely Google-signed and let the deployment's `run.invoker`
 * IAM restrict WHO (gcp-identity warns loudly, once, if the service is actually public and thus the
 * edge is NOT the gate). A non-empty list (`@AuthOidc('svc-a')`) enforces that explicit app-level
 * allow-list as defense-in-depth. Off-GCP, gcp-identity mints + accepts a dev token so local dev needs
 * no GCP. Framework code reads NO process.env — an app that wants an env-driven allow-list binds an
 * {@link OidcHook} instead (env read at its composition root), keeping this default env-free and tests
 * parallel-safe.
 */
export declare class DefaultOidcVerifier {
    private readonly gcpOidc;
    constructor(gcpOidc: GcpOidc);
    verify(token: string, callers: string[]): Promise<void>;
}