import { z } from '@frontmcp/lazy-zod';
import { FlowBase, type FlowRunOptions } from '../../common';
/**
 * Validated OAuth authorization request for orchestrated mode
 */
declare const oauthAuthorizeRequestSchema: import("@frontmcp/lazy-zod").ZodObject<{
    response_type: import("@frontmcp/lazy-zod").ZodLiteral<"code">;
    client_id: import("@frontmcp/lazy-zod").ZodString;
    redirect_uri: import("zod").ZodURL;
    code_challenge: import("@frontmcp/lazy-zod").ZodString;
    code_challenge_method: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodLiteral<"S256">>>;
    scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    state: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    resource: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
}, import("zod/v4/core").$strip>;
/**
 * Minimal request for anonymous/default provider mode
 */
declare const anonymousAuthorizeRequestSchema: import("@frontmcp/lazy-zod").ZodObject<{
    redirect_uri: import("zod").ZodURL;
    state: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
}, import("zod/v4/core").$strip>;
export type OAuthAuthorizeRequest = z.infer<typeof oauthAuthorizeRequestSchema>;
export type AnonymousAuthorizeRequest = z.infer<typeof anonymousAuthorizeRequestSchema>;
declare const inputSchema: import("@frontmcp/lazy-zod").ZodObject<{
    request: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
    response: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
    next: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodFunction<import("zod/v4/core").$ZodFunctionArgs, import("zod/v4/core").$ZodFunctionOut>>;
}, import("zod/v4/core").$strip>;
declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
    isDefaultAuthProvider: import("@frontmcp/lazy-zod").ZodBoolean;
    isOrchestrated: import("@frontmcp/lazy-zod").ZodBoolean;
    allowAnonymous: import("@frontmcp/lazy-zod").ZodBoolean;
    validatedRequest: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
        response_type: import("@frontmcp/lazy-zod").ZodLiteral<"code">;
        client_id: import("@frontmcp/lazy-zod").ZodString;
        redirect_uri: import("zod").ZodURL;
        code_challenge: import("@frontmcp/lazy-zod").ZodString;
        code_challenge_method: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodLiteral<"S256">>>;
        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        state: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        resource: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    }, import("zod/v4/core").$strip>>;
    rawRedirectUri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    rawState: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    validationErrors: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
    pendingAuthId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    isIncrementalAuth: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
    targetAppId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    targetToolId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    existingSessionId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    priorAuthorizedAppIds: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
    requiresFederatedLogin: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
    requiresConsent: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
    isCimdClient: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
    cimdMetadata: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
        client_id: import("@frontmcp/lazy-zod").ZodString;
        client_name: import("@frontmcp/lazy-zod").ZodString;
        redirect_uris: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
        token_endpoint_auth_method: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodEnum<{
            none: "none";
            client_secret_basic: "client_secret_basic";
            client_secret_post: "client_secret_post";
            private_key_jwt: "private_key_jwt";
        }>>;
        grant_types: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
        response_types: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
        client_uri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        logo_uri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        jwks_uri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        jwks: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
            keys: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnknown>>;
        }, import("zod/v4/core").$strip>>;
        tos_uri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        policy_uri: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        contacts: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
        software_statement: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        software_id: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        software_version: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    }, import("zod/v4/core").$strip>>;
}, import("zod/v4/core").$strip>;
declare const outputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"redirect">;
    status: import("@frontmcp/lazy-zod").ZodDefault<z.ZodType<301 | 302 | 303 | 307 | 308, unknown>>;
    location: import("@frontmcp/lazy-zod").ZodString;
    headers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>]>>>>;
    cookies: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
        name: import("@frontmcp/lazy-zod").ZodString;
        value: import("@frontmcp/lazy-zod").ZodString;
        path: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
        domain: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        httpOnly: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
        secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
        sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
            strict: "strict";
            none: "none";
            lax: "lax";
        }>>;
        maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
        expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
    }, import("zod/v4/core").$strip>>>>;
}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"text">;
    status: import("@frontmcp/lazy-zod").ZodNumber;
    body: import("@frontmcp/lazy-zod").ZodString;
    contentType: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
    headers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>]>>>>;
    cookies: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
        name: import("@frontmcp/lazy-zod").ZodString;
        value: import("@frontmcp/lazy-zod").ZodString;
        path: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
        domain: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        httpOnly: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
        secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
        sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
            strict: "strict";
            none: "none";
            lax: "lax";
        }>>;
        maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
        expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
    }, import("zod/v4/core").$strip>>>>;
}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
    status: import("@frontmcp/lazy-zod").ZodNumber;
    body: import("@frontmcp/lazy-zod").ZodString;
    headers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>]>>>>;
    cookies: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
        name: import("@frontmcp/lazy-zod").ZodString;
        value: import("@frontmcp/lazy-zod").ZodString;
        path: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
        domain: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        httpOnly: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
        secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
        sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
            strict: "strict";
            none: "none";
            lax: "lax";
        }>>;
        maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
        expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
    }, import("zod/v4/core").$strip>>>>;
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"html">;
    contentType: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodLiteral<"text/html; charset=utf-8">>;
}, import("zod/v4/core").$strip>]>;
declare const plan: {
    readonly pre: ["parseInput", "validateInput", "checkIfAuthorized"];
    readonly execute: ["prepareAuthorizationRequest", "buildAuthorizeOutput"];
    readonly post: ["validateOutput"];
};
declare global {
    interface ExtendFlows {
        'oauth:authorize': FlowRunOptions<OauthAuthorizeFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
    }
}
declare const name: "oauth:authorize";
export default class OauthAuthorizeFlow extends FlowBase<typeof name> {
    private logger;
    parseInput(): Promise<void>;
    validateInput(): Promise<void>;
    checkIfAuthorized(): Promise<void>;
    prepareAuthorizationRequest(): Promise<void>;
    buildAuthorizeOutput(): Promise<void>;
    /**
     * Render a custom `@AuthUi` slot when one is registered for this scope.
     *
     * Mints the per-pending-auth CSRF token (server-owned), persists it onto the
     * pending authorization record (so the callback can verify it across nodes),
     * builds the {@link AuthFlowState} via `buildState`, SSRs the registered
     * component, and responds with the assembled page + CSP / anti-clickjacking
     * headers. Returns `true` when it handled the slot (caller should `return`),
     * `false` to fall through to the built-in page (no renderer / build failed).
     */
    private tryRenderCustomSlot;
    /**
     * Remote mode (`mode: 'remote'`) auto-federation.
     *
     * Builds a federated auth session for the SINGLE mandatory upstream provider
     * registered by {@link LocalPrimaryAuth.registerRemoteProvider}, starts it
     * (fresh PKCE + state), persists the session, and redirects straight to the
     * upstream IdP's authorization endpoint. This reuses the exact federated
     * machinery the multi-provider local path uses (`/oauth/provider/:id/callback`
     * then completes the exchange, stores upstream tokens, and mints the FrontMCP
     * session token whose identity comes from the upstream user) — but skips the
     * in-tree login page and the provider-selection page entirely.
     *
     * No identity is collected in-tree: the federated session is created with an
     * EMPTY `userInfo` so the minted token's `sub`/`email`/`name` derive solely
     * from the upstream provider (see the provider-callback flow).
     */
    private startRemoteFederation;
    validateOutput(): Promise<void>;
    /**
     * Enforce the local-AS DCR allowlists (#462) at authorize time. Returns a
     * human-readable rejection reason, or `undefined` when the request is allowed
     * (including when no allowlist is configured, or the auth instance does not
     * expose a DCR registry — e.g. non-local modes).
     *
     * - `allowedRedirectUris`: applies to ALL clients (CIMD or not) as an
     *   open-redirect / lateral-movement guard.
     * - `allowedClientIds`: applies only to non-CIMD client ids; CIMD URLs are
     *   validated by the CIMD layer instead.
     */
    private checkDcrAllowlist;
    /**
     * Format Zod errors into human-readable strings
     */
    private formatZodErrors;
    /**
     * Respond with OAuth error - redirect if possible, otherwise show error page
     */
    private respondWithError;
    /**
     * Render the local login page.
     *
     * Honors `auth.login` (Checkpoint 3a): a `login.render` override yields full
     * custom HTML, `login.fields` extends the built-in form, and otherwise the
     * unchanged default email/name page is rendered. Rendering is delegated to
     * the shared `renderLocalLoginPage` helper so the authorize flow and the
     * callback error re-render stay in sync.
     */
    private renderLoginPage;
    /**
     * Render incremental authorization page for a single app using HTMX templates
     */
    private renderIncrementalAuthPage;
    /**
     * Render federated login page for multiple auth providers using HTMX templates
     */
    private renderFederatedLoginPage;
    /**
     * Render an error page
     */
    private renderErrorPage;
}
export {};
//# sourceMappingURL=oauth.authorize.flow.d.ts.map