/**
 * Token Endpoint — POST /oauth/token
 *
 * Who calls: Client (server-to-server).
 *
 * When: After getting the code (or for refresh).
 *
 * Purpose: Exchange authorization code + PKCE verifier for access token (and optional refresh token), or refresh an access token.
 */
/**
 * Typical parameter shapes
 *
 * /oauth/token (POST, application/x-www-form-urlencoded)
 *
 * For code exchange: grant_type=authorization_code, code, redirect_uri, client_id (and auth), code_verifier
 *
 * For refresh: grant_type=refresh_token, refresh_token, client_id (and auth)
 */
/**
 * Quick checklist (security & correctness)
 * - PKCE (S256) required for public clients (and basically for all).
 * - Use authorization code grant only (no implicit/hybrid).
 * - Rotate refresh tokens and bind them to client + user + scopes.
 * - Prefer private_key_jwt or mTLS for confidential clients.
 * - PAR + JAR recommended for higher security.
 * - Consider DPoP (proof-of-possession) to reduce token replay.
 * - Keep codes very short-lived (e.g., ≤60 s) and single-use.
 * - Publish discovery and JWKS, rotate keys safely.
 * - Decide JWT vs opaque access tokens; provide introspection if opaque.
 */
import { FlowBase, type FlowRunOptions } from '../../common';
declare const inputSchema: import("@frontmcp/lazy-zod").ZodObject<{
    request: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
    response: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
    next: import("@frontmcp/lazy-zod").ZodOptional<import("zod").ZodFunction<import("zod/v4/core").$ZodFunctionArgs, import("zod/v4/core").$ZodFunctionOut>>;
}, import("zod/v4/core").$strip>;
declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
    body: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDiscriminatedUnion<[import("@frontmcp/lazy-zod").ZodObject<{
        grant_type: import("@frontmcp/lazy-zod").ZodLiteral<"anonymous">;
        client_id: import("@frontmcp/lazy-zod").ZodString;
        resource: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
        grant_type: import("@frontmcp/lazy-zod").ZodLiteral<"authorization_code">;
        code: import("@frontmcp/lazy-zod").ZodString;
        redirect_uri: import("@frontmcp/lazy-zod").ZodString;
        client_id: import("@frontmcp/lazy-zod").ZodString;
        client_secret: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        code_verifier: import("@frontmcp/lazy-zod").ZodString;
    }, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
        grant_type: import("@frontmcp/lazy-zod").ZodLiteral<"refresh_token">;
        refresh_token: import("@frontmcp/lazy-zod").ZodString;
        client_id: import("@frontmcp/lazy-zod").ZodString;
        client_secret: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    }, import("zod/v4/core").$strip>], "grant_type">>;
    grantType: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
        authorization_code: "authorization_code";
        refresh_token: "refresh_token";
        anonymous: "anonymous";
    }>>;
    isDefaultAuthProvider: import("@frontmcp/lazy-zod").ZodBoolean;
    isOrchestrated: import("@frontmcp/lazy-zod").ZodBoolean;
    tokenResponse: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
        access_token: import("@frontmcp/lazy-zod").ZodString;
        token_type: import("@frontmcp/lazy-zod").ZodLiteral<"Bearer">;
        expires_in: import("@frontmcp/lazy-zod").ZodNumber;
        refresh_token: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        scope: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    }, import("zod/v4/core").$strip>>;
    error: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    errorDescription: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
}, import("zod/v4/core").$strip>;
declare const outputSchema: import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"json">;
    status: import("@frontmcp/lazy-zod").ZodNumber;
    body: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodAny>, import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodAny>]>;
    contentType: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
    headers: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodRecord<import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>]>>>>;
    cookies: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodObject<{
        name: import("@frontmcp/lazy-zod").ZodString;
        value: import("@frontmcp/lazy-zod").ZodString;
        path: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodString>;
        domain: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        httpOnly: import("@frontmcp/lazy-zod").ZodDefault<import("@frontmcp/lazy-zod").ZodBoolean>;
        secure: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
        sameSite: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
            strict: "strict";
            none: "none";
            lax: "lax";
        }>>;
        maxAge: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
        expires: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodDate>;
    }, import("zod/v4/core").$strip>>>>;
}, import("zod/v4/core").$strip>;
declare const plan: {
    readonly pre: ["parseInput", "validateInput"];
    readonly execute: ["handleAuthorizationCodeGrant", "handleRefreshTokenGrant", "handleAnonymousGrant", "buildTokenResponse"];
    readonly post: ["validateOutput"];
};
declare global {
    interface ExtendFlows {
        'oauth:token': FlowRunOptions<OauthTokenFlow, typeof plan, typeof inputSchema, typeof outputSchema, typeof stateSchema>;
    }
}
declare const name: "oauth:token";
export default class OauthTokenFlow extends FlowBase<typeof name> {
    private logger;
    parseInput(): Promise<void>;
    validateInput(): Promise<void>;
    handleAuthorizationCodeGrant(): Promise<void>;
    handleRefreshTokenGrant(): Promise<void>;
    handleAnonymousGrant(): Promise<void>;
    buildTokenResponse(): Promise<void>;
    validateOutput(): Promise<void>;
}
export {};
//# sourceMappingURL=oauth.token.flow.d.ts.map