/**
 * Dynamic Client Registration — POST /oauth/register
 *
 * Who calls: Developers/automation.
 *
 * Purpose: Let clients register programmatically (redirect URIs, grant types, etc.).
 *
 * Control surface (#462): the LOCAL Authorization Server's DCR is governed by
 * the declarative `auth.dcr` block. When `dcr` is omitted the historical
 * behavior is preserved exactly — registration is enabled in development and
 * disabled in production (via `isProduction()`), with no allowlist and no
 * initial access token. When configured, this flow enforces:
 *   - `dcr.enabled === false` → 404 (behave as if the endpoint does not exist)
 *   - `dcr.initialAccessToken` → require `Authorization: Bearer <token>` (401)
 *   - `dcr.allowedClientIds` → registrations are pinned to an allowed id (400)
 *   - `dcr.allowedRedirectUris` → reject unlisted redirect_uris (400)
 * Registered clients are stored on the per-instance {@link DcrClientRegistry}
 * (LocalPrimaryAuth), so the authorize/token flows can validate them.
 */
import { FlowBase, type FlowRunOptions } from '../../common';
declare const inputSchema: import("@frontmcp/lazy-zod").ZodObject<{
    request: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
    response: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
    next: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodFunction<import("zod/v4/core").$ZodFunctionArgs, import("zod/v4/core").$ZodFunctionOut>>;
}, import("zod/v4/core").$strip>;
declare const outputSchema: import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"json">;
    status: import("@frontmcp/lazy-zod").ZodNumber;
    body: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodAny>, import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodAny>]>;
    contentType: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
    headers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>]>>>>;
    cookies: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
        name: import("@frontmcp/lazy-zod").ZodString;
        value: import("@frontmcp/lazy-zod").ZodString;
        path: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
        domain: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        httpOnly: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
        secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
        sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
            strict: "strict";
            none: "none";
            lax: "lax";
        }>>;
        maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
        expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
    }, import("zod/v4/core").$strip>>>>;
}, import("zod/v4/core").$strip>;
declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
    body: import("@frontmcp/lazy-zod").ZodObject<{
        redirect_uris: import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>;
        token_endpoint_auth_method: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodEnum<{
            none: "none";
            client_secret_basic: "client_secret_basic";
            client_secret_post: "client_secret_post";
            private_key_jwt: "private_key_jwt";
            tls_client_auth: "tls_client_auth";
        }>>;
        grant_types: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodEnum<{
            authorization_code: "authorization_code";
            refresh_token: "refresh_token";
            "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
        }>>>;
        response_types: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodEnum<{
            code: "code";
        }>>>;
        client_name: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    }, import("zod/v4/core").$loose>;
    dcrEnabled: import("@frontmcp/lazy-zod").ZodBoolean;
}, import("zod/v4/core").$strip>;
declare const plan: {
    readonly pre: ["parseInput", "validateInput"];
    readonly execute: ["registerClient", "respondRegistration"];
    readonly post: ["validateOutput"];
};
declare global {
    interface ExtendFlows {
        'oauth:register': FlowRunOptions<OauthRegisterFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
    }
}
declare const name: "oauth:register";
export default class OauthRegisterFlow extends FlowBase<typeof name> {
    private registered?;
    /** The local AS primary auth, which owns the DCR client registry (#462). */
    private get localAuth();
    parseInput(): Promise<void>;
    validateInput(): Promise<void>;
    registerClient(): Promise<void>;
    respondRegistration(): Promise<void>;
    validateOutput(): Promise<void>;
}
export {};
//# sourceMappingURL=oauth.register.flow.d.ts.map