/**
 * OAuth Provider Callback Endpoint — GET /oauth/provider/:providerId/callback
 *
 * Who calls: Browser after user completes OAuth with an upstream provider
 *
 * When: During multi-provider (federated) authentication flow
 *
 * Purpose: Exchange upstream provider's authorization code for tokens,
 *          store tokens securely, then redirect to next provider or complete auth
 *
 * Flow:
 * 1. User selects providers on federated login page
 * 2. System redirects to first provider's /authorize
 * 3. User completes auth with provider
 * 4. Provider redirects here with authorization code
 * 5. We exchange code for tokens, store them
 * 6. If more providers in queue, redirect to next
 * 7. If all providers done, issue FrontMCP JWT
 */
import { z } from '@frontmcp/lazy-zod';
import { FlowBase, type FlowRunOptions } from '../../common';
declare const inputSchema: import("@frontmcp/lazy-zod").ZodObject<{
    request: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
    response: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
    next: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodFunction<import("zod/v4/core").$ZodFunctionArgs, import("zod/v4/core").$ZodFunctionOut>>;
}, import("zod/v4/core").$strip>;
declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
    providerId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    code: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    error: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    errorDescription: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    providerState: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    federatedSessionId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    federatedSession: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnknown>;
    providerTokens: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnknown>;
    providerUserInfo: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnknown>;
    consentSessionId: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    consentSubmitted: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
    selectedTools: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>>;
}, import("zod/v4/core").$strip>;
declare const outputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"redirect">;
    status: import("@frontmcp/lazy-zod").ZodDefault<z.ZodType<301 | 302 | 303 | 307 | 308, unknown>>;
    location: import("@frontmcp/lazy-zod").ZodString;
    headers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>]>>>>;
    cookies: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
        name: import("@frontmcp/lazy-zod").ZodString;
        value: import("@frontmcp/lazy-zod").ZodString;
        path: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
        domain: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        httpOnly: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
        secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
        sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
            strict: "strict";
            none: "none";
            lax: "lax";
        }>>;
        maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
        expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
    }, import("zod/v4/core").$strip>>>>;
}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
    status: import("@frontmcp/lazy-zod").ZodNumber;
    body: import("@frontmcp/lazy-zod").ZodString;
    headers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>]>>>>;
    cookies: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
        name: import("@frontmcp/lazy-zod").ZodString;
        value: import("@frontmcp/lazy-zod").ZodString;
        path: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
        domain: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        httpOnly: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
        secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
        sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
            strict: "strict";
            none: "none";
            lax: "lax";
        }>>;
        maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
        expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
    }, import("zod/v4/core").$strip>>>>;
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"html">;
    contentType: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodLiteral<"text/html; charset=utf-8">>;
}, import("zod/v4/core").$strip>]>;
declare const plan: {
    readonly pre: ["parseInput", "handleConsentSubmission", "loadFederatedSession", "validateProviderCallback"];
    readonly execute: ["exchangeProviderCode", "storeProviderTokens", "handleNextProviderOrComplete"];
};
declare global {
    interface ExtendFlows {
        'oauth:provider-callback': FlowRunOptions<OauthProviderCallbackFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
    }
}
declare const name: "oauth:provider-callback";
export default class OauthProviderCallbackFlow extends FlowBase<typeof name> {
    private logger;
    /**
     * Get LocalPrimaryAuth instance with type safety
     * @throws Error if auth is not LocalPrimaryAuth
     */
    private getLocalAuth;
    parseInput(): Promise<void>;
    /**
     * Handle a consent-screen submission for a federated login.
     *
     * Federated logins complete (mint the code) here, AFTER all providers are
     * linked. When consent mode is enabled, {@link completeFederatedAuth} first
     * renders the consent screen, which GETs back to this endpoint with
     * `consent_session=<sessionId>` + `tools=`. This stage loads that still alive
     * session, applies the selection (validating + `requireSelection`), and
     * completes the mint — short-circuiting the provider-code path entirely.
     */
    handleConsentSubmission(): Promise<void>;
    loadFederatedSession(): Promise<void>;
    validateProviderCallback(): Promise<void>;
    exchangeProviderCode(): Promise<void>;
    storeProviderTokens(): Promise<void>;
    handleNextProviderOrComplete(): Promise<void>;
    /**
     * Complete the federated auth flow and issue FrontMCP JWT.
     *
     * When consent mode is enabled this runs in two passes:
     *  1. First reach (no `consent.consentSubmitted`): render the consent screen,
     *     which GETs back to this endpoint with `consent_session` + `tools=`. The
     *     federated session is kept ALIVE for the round-trip.
     *  2. Resubmit (`consent.consentSubmitted` true): validate the selection
     *     (honoring `requireSelection`) and mint the code with the consented set.
     *
     * With consent disabled, it mints immediately (historical behavior).
     */
    private completeFederatedAuth;
    /**
     * Render the federated consent screen. The form GETs back to this provider
     * callback endpoint with `consent_session=<sessionId>` + the chosen `tools=`
     * (and `consent_submitted=1`), so {@link handleConsentSubmission} completes
     * the mint. Honors the same `auth.consent` flags as the non-federated path.
     */
    private renderConsentScreen;
    /**
     * Generate a deterministic user sub from email
     */
    private generateUserSub;
    /**
     * Render an error page
     */
    private renderErrorPage;
    private getStateValidation;
}
export {};
//# sourceMappingURL=oauth.provider-callback.flow.d.ts.map