import { FlowBase, type FlowRunOptions } from '../../common';
import 'reflect-metadata';
declare const inputSchema: import("@frontmcp/lazy-zod").ZodObject<{
    request: import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>;
}, import("zod/v4/core").$strip>;
declare const stateSchema: import("@frontmcp/lazy-zod").ZodObject<{
    baseUrl: import("@frontmcp/lazy-zod").ZodString;
    authorizationHeader: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    token: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    sessionIdHeader: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    sessionProtocol: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    userAgent: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    prmMetadataPath: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    prmMetadataHeader: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    prmUrl: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    jwtPayload: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{}, import("zod/v4/core").$loose>>;
    user: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
        iss: import("@frontmcp/lazy-zod").ZodString;
        sid: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        sub: import("@frontmcp/lazy-zod").ZodString;
        exp: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
        iat: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
        aud: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>>;
        email: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        username: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        preferred_username: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        name: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        picture: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
    }, import("zod/v4/core").$loose>>;
    session: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
        id: import("@frontmcp/lazy-zod").ZodString;
        payload: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
            nodeId: import("@frontmcp/lazy-zod").ZodString;
            authSig: import("@frontmcp/lazy-zod").ZodString;
            uuid: import("@frontmcp/lazy-zod").ZodString;
            iat: import("@frontmcp/lazy-zod").ZodNumber;
            protocol: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
                "legacy-sse": "legacy-sse";
                sse: "sse";
                "streamable-http": "streamable-http";
                "stateful-http": "stateful-http";
                "stateless-http": "stateless-http";
            }>>;
            isPublic: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
            platformType: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
                unknown: "unknown";
                continue: "continue";
                openai: "openai";
                claude: "claude";
                gemini: "gemini";
                cursor: "cursor";
                cody: "cody";
                "generic-mcp": "generic-mcp";
                "ext-apps": "ext-apps";
            }>>;
            clientName: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
            clientVersion: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
            supportsElicitation: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
            skillsOnlyMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
        }, import("zod/v4/core").$strip>>;
    }, import("zod/v4/core").$strip>>;
}, import("zod/v4/core").$strip>;
export declare const sessionVerifyOutputSchema: import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"unauthorized">;
    prmMetadataHeader: import("@frontmcp/lazy-zod").ZodString;
}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"authorized">;
    authorization: import("@frontmcp/lazy-zod").ZodObject<{
        token: import("@frontmcp/lazy-zod").ZodString;
        session: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
            id: import("@frontmcp/lazy-zod").ZodString;
            payload: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodObject<{
                nodeId: import("@frontmcp/lazy-zod").ZodString;
                authSig: import("@frontmcp/lazy-zod").ZodString;
                uuid: import("@frontmcp/lazy-zod").ZodString;
                iat: import("@frontmcp/lazy-zod").ZodNumber;
                protocol: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
                    "legacy-sse": "legacy-sse";
                    sse: "sse";
                    "streamable-http": "streamable-http";
                    "stateful-http": "stateful-http";
                    "stateless-http": "stateless-http";
                }>>;
                isPublic: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
                platformType: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodEnum<{
                    unknown: "unknown";
                    continue: "continue";
                    openai: "openai";
                    claude: "claude";
                    gemini: "gemini";
                    cursor: "cursor";
                    cody: "cody";
                    "generic-mcp": "generic-mcp";
                    "ext-apps": "ext-apps";
                }>>;
                clientName: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
                clientVersion: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
                supportsElicitation: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
                skillsOnlyMode: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodBoolean>;
            }, import("zod/v4/core").$strip>>;
        }, import("zod/v4/core").$strip>>;
        user: import("@frontmcp/lazy-zod").ZodObject<{
            iss: import("@frontmcp/lazy-zod").ZodString;
            sid: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
            sub: import("@frontmcp/lazy-zod").ZodString;
            exp: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
            iat: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodNumber>;
            aud: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodUnion<readonly [import("@frontmcp/lazy-zod").ZodString, import("@frontmcp/lazy-zod").ZodArray<import("@frontmcp/lazy-zod").ZodString>]>>;
            email: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
            username: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
            preferred_username: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
            name: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
            picture: import("@frontmcp/lazy-zod").ZodOptional<import("@frontmcp/lazy-zod").ZodString>;
        }, import("zod/v4/core").$loose>;
    }, import("zod/v4/core").$strip>;
}, import("zod/v4/core").$strip>, import("@frontmcp/lazy-zod").ZodObject<{
    kind: import("@frontmcp/lazy-zod").ZodLiteral<"forbidden">;
    prmMetadataHeader: import("@frontmcp/lazy-zod").ZodString;
}, import("zod/v4/core").$strip>]>;
declare const plan: {
    readonly pre: ["parseInput", "handlePublicMode", "handleAnonymousFallback", "requireAuthorizationHeader", "verifyIfJwt"];
    readonly execute: ["deriveUser", "parseSessionHeader", "buildAuthorizedOutput"];
};
declare global {
    interface ExtendFlows {
        'session:verify': FlowRunOptions<SessionVerifyFlow, typeof plan, typeof inputSchema, typeof sessionVerifyOutputSchema, typeof stateSchema>;
    }
}
declare const name: "session:verify";
export default class SessionVerifyFlow extends FlowBase<typeof name> {
    logger: import("../../common").FrontMcpLogger;
    private maskSub;
    /**
     * Create an anonymous session with consistent structure for both public and transparent-anon modes.
     * Encapsulates the shared logic for session creation, payload encryption, and user derivation.
     */
    private createAnonymousSession;
    parseInput(): Promise<void>;
    /**
     * Handle public mode - allow anonymous access without requiring authorization
     * In public mode, we create an anonymous authorization with a stateful session
     * but NO token. This allows public docs/CI to work without Authorization header.
     *
     * CRITICAL: When client sends mcp-session-id header, we MUST use that exact ID
     * for transport registry lookup. Creating a new session ID would cause mismatch.
     */
    handlePublicMode(): Promise<void>;
    /**
     * Handle transparent mode with allowAnonymous when no token is provided
     * This creates an anonymous session similar to public mode but for transparent auth
     */
    handleAnonymousFallback(): Promise<void>;
    requireAuthorizationOrChallenge(): Promise<void>;
    /**
     * If Authorization is a JWT:
     *  - Attempt verification against any known / cached public keys we have (gateway/local)
     *  - If verification fails → 401
     *  - If verification ok → capture payload
     * If NOT a JWT:
     *  - we do NOT attempt verification, just pass the raw token through
     */
    verifyIfJwt(): Promise<void>;
    deriveUser(): Promise<void>;
    /**
     * Parse the session header (mcp-session-id)
     * - If session id is present, validate it
     * - If valid, capture the session info
     * - If NOT valid, ignore (no session)
     */
    parseSessionHeader(): Promise<void>;
    buildAuthorizedOutput(): Promise<void>;
}
export {};
//# sourceMappingURL=session.verify.flow.d.ts.map