/**
 * OAuth Connect Endpoint — GET|POST /oauth/connect (Checkpoint 3b)
 *
 * Mid-session add-credential flow reached via a FRAMEWORK-SIGNED resume URL that
 * `this.credentials.requireConnect({ key })` hands back when a credential is not
 * connected.
 *
 *   - GET  /oauth/connect?token=…  → verify the signed token, render a single
 *     add-credential field (reusing the 3a `login.fields` render surface).
 *   - POST /oauth/connect          → re-verify the token, re-invoke the
 *     configured `authenticate({ fields, resume: { sub, key, context } })`
 *     verifier, and ADDITIVELY store the returned credential into the user's
 *     EXISTING vault. Refuses when there is no live vault (never mints a new one)
 *     so a stale link cannot resurrect a rotated-away session.
 *
 * This is auth-internal: it lives on the existing OAuth flow surface (registered
 * by LocalPrimaryAuth), not via the public custom-route feature.
 */
import { FlowBase, type FlowRunOptions } from '../../common';
declare const inputSchema: import("@frontmcp/lazy-zod").ZodObject<{
    request: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
    response: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
    next: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodFunction<import("zod/v4/core").$ZodFunctionArgs, import("zod/v4/core").$ZodFunctionOut>>;
}, import("zod/v4/core").$strip>;
declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
    method: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    token: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    fields: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodString>>;
}, import("zod/v4/core").$strip>;
declare const outputSchema: import("@frontmcp/lazy-zod").ZodObject<{
    status: import("@frontmcp/lazy-zod").ZodNumber;
    body: import("@frontmcp/lazy-zod").ZodString;
    headers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>]>>>>;
    cookies: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
        name: import("@frontmcp/lazy-zod").ZodString;
        value: import("@frontmcp/lazy-zod").ZodString;
        path: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
        domain: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        httpOnly: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
        secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
        sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
            strict: "strict";
            none: "none";
            lax: "lax";
        }>>;
        maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
        expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
    }, import("zod/v4/core").$strip>>>>;
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"html">;
    contentType: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodLiteral<"text/html; charset=utf-8">>;
}, import("zod/v4/core").$strip>;
declare const plan: {
    readonly pre: ["parseInput"];
    readonly execute: ["handleConnect"];
};
declare global {
    interface ExtendFlows {
        'oauth:connect': FlowRunOptions<OauthConnectFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
    }
}
declare const name: "oauth:connect";
export default class OauthConnectFlow extends FlowBase<typeof name> {
    private logger;
    parseInput(): Promise<void>;
    handleConnect(): Promise<void>;
    /** Verify the signed resume token against the server secret (constant-time + expiry). */
    private verifyToken;
    /** Resolve the single credential field to render from `login.fields` (first field), or a default. */
    private resolveConnectField;
    /** Render the single-field connect page (reusing the login field renderer). */
    private renderConnectPage;
    /**
     * Build the {@link AuthenticateContext} and invoke the verifier with the resume
     * context. A throwing verifier is converted into a clean failure.
     */
    private runAuthenticate;
    /** Outbound fetch handed to the verifier (routes through the auth instance when available). */
    private contextFetch;
    /** Fire a `notifications/resources/updated` to connected sessions (best-effort). */
    private notifyResourcesUpdated;
    /** Parse a urlencoded/JSON POST body into a flat record. */
    private coerceBody;
    /** Collect submitted credential field values from query + body (excluding reserved params). */
    private collectFields;
    /** Render a small error page (escaped). */
    private renderError;
}
export {};
//# sourceMappingURL=oauth.connect.flow.d.ts.map