import { FlowBase, type FlowRunOptions } from '../../common';
import 'reflect-metadata';
import { type Authorization } from '@frontmcp/auth';
import { z } from '@frontmcp/lazy-zod';
declare const inputSchema: import("@frontmcp/lazy-zod").ZodObject<{
    request: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
}, import("zod/v4/core").$strip>;
declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
    baseUrl: import("@frontmcp/lazy-zod").ZodString;
    authorizationHeader: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    token: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    sessionIdHeader: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    prmUrl: import("@frontmcp/lazy-zod").ZodString;
    wwwAuthenticateHeader: import("@frontmcp/lazy-zod").ZodString;
    authMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
        public: "public";
        transparent: "transparent";
        orchestrated: "orchestrated";
    }>>;
    jwtPayload: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>>;
    user: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
        sub: import("@frontmcp/lazy-zod").ZodString;
        name: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        email: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        picture: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        anonymous: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
    }, import("zod/v4/core").$strip>>;
}, import("zod/v4/core").$strip>;
export declare const authVerifyOutputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"unauthorized">;
    wwwAuthenticateHeader: import("@frontmcp/lazy-zod").ZodString;
    reason: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"authorized">;
    authorization: import("zod").ZodCustom<Authorization, Authorization>;
    llmContext: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
        authorizationId: import("@frontmcp/lazy-zod").ZodString;
        sessionId: import("@frontmcp/lazy-zod").ZodString;
        mode: import("@frontmcp/lazy-zod").ZodEnum<{
            public: "public";
            transparent: "transparent";
            orchestrated: "orchestrated";
        }>;
        isAnonymous: import("@frontmcp/lazy-zod").ZodBoolean;
        user: import("@frontmcp/lazy-zod").ZodObject<{
            sub: import("@frontmcp/lazy-zod").ZodString;
            name: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        }, import("zod/v4/core").$strip>;
        scopes: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
        authorizedToolIds: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
        authorizedPromptIds: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
    }, import("zod/v4/core").$strip>>;
}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"forbidden">;
    wwwAuthenticateHeader: import("@frontmcp/lazy-zod").ZodString;
    reason: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
}, import("zod/v4/core").$strip>]>;
export type AuthVerifyOutput = z.infer<typeof authVerifyOutputSchema>;
declare const plan: {
    readonly pre: ["parseInput", "determineAuthMode", "handlePublicMode", "handleAnonymousFallback", "requireAuthorizationHeader", "verifyToken"];
    readonly execute: ["buildAuthorization"];
};
declare global {
    interface ExtendFlows {
        'auth:verify': FlowRunOptions<AuthVerifyFlow, typeof plan, typeof inputSchema, typeof authVerifyOutputSchema, typeof stateSchema>;
    }
}
declare const name: "auth:verify";
/**
 * Auth Verify Flow
 *
 * New authorization verification flow that supports the three auth modes:
 * - public: Auto-generate anonymous authorization
 * - transparent: Pass-through OAuth tokens from upstream provider
 * - orchestrated: Local auth server with secure token storage
 *
 * This flow creates Authorization objects instead of legacy Session objects.
 */
export default class AuthVerifyFlow extends FlowBase<typeof name> {
    private logger;
    /**
     * Parse request headers and build WWW-Authenticate header
     */
    parseInput(): Promise<void>;
    /**
     * Determine which auth mode to use based on scope configuration
     */
    determineAuthMode(): Promise<void>;
    /**
     * Handle public mode - create anonymous authorization without requiring a token
     */
    handlePublicMode(): Promise<void>;
    /**
     * Handle transparent mode with allowAnonymous when no token is provided
     * Uses the same TTL and issuer configuration as handlePublicMode for consistency
     */
    handleAnonymousFallback(): Promise<void>;
    /**
     * Require authorization header for non-public modes (unless allowAnonymous is set)
     */
    requireAuthorizationHeader(): Promise<void>;
    /**
     * Verify the JWT token
     */
    verifyToken(): Promise<void>;
    /**
     * Build the Authorization object based on auth mode
     */
    buildAuthorization(): Promise<void>;
    /**
     * Parse TTL from string or number
     */
    private parseTtl;
    /**
     * Parse scopes from JWT claim
     */
    private parseScopes;
}
export {};
//# sourceMappingURL=auth.verify.flow.d.ts.map