/**
 * The state persisted between the `/authorize` redirect and the callback.
 * `state` guards against CSRF and `code_verifier` is the PKCE secret, so both
 * have to stay in the browser that started the flow. `redirect_uri` is here
 * because it must be replayed byte-for-byte at the `/token` exchange
 * (RFC 6749 §4.1.3) — take it from here, never rebuild it from
 * `window.location`, which by then carries the appended `code` and `state`
 * and a re-serialized query.
 *
 * The post-login destination is deliberately NOT stored here. It rides in the
 * `redirect_uri`'s own query (`<origin>/login/callback?redirect=%2Fusers`), so
 * the authorization server carries it back and any client can use the same
 * mechanism without agreeing on a storage convention.
 */
export type AuthorizationRequest = {
    state: string;
    code_verifier: string;
    redirect_uri: string;
    client_id: string;
    realm_id?: string;
};
export declare function saveAuthorizationRequest(request: AuthorizationRequest): void;
export declare function loadAuthorizationRequest(): AuthorizationRequest | undefined;
export declare function clearAuthorizationRequest(): void;
export type BuildAuthorizeURLContext = {
    baseURL: string;
    clientId: string;
    realmId?: string;
    redirectUri: string;
    scope?: string;
    state: string;
    codeChallenge: string;
    codeChallengeMethod: string;
    /**
     * OIDC `prompt`. Defaults to `select_account` so a lingering session offers
     * "continue as / use another account" instead of silently continuing. Pass
     * `''` to opt out, or `none`/`login` for silent-auth / forced re-auth.
     */
    prompt?: string;
    maxAge?: number;
    loginHint?: string;
};
export declare function buildAuthorizeURL(ctx: BuildAuthorizeURLContext): string;
export type BuildEndSessionURLContext = {
    baseURL: string;
    idTokenHint?: string;
    clientId?: string;
    postLogoutRedirectUri?: string;
    state?: string;
    realmId?: string;
};
/**
 * Build an OIDC RP-Initiated Logout URL for the `end_session_endpoint`.
 */
export declare function buildEndSessionURL(ctx: BuildEndSessionURLContext): string;
export type BuildConsoleLoginURLContext = {
    baseURL: string;
    /**
     * The console whose login is being started. Its OAuth2 client and its
     * return target are what differ per console, which is why this half of the
     * flow is per-console while the session it produces is not (plan 088).
     */
    console?: string;
    realmId?: string;
};
/**
 * Build the URL of a console's server-side login kick.
 *
 * A NAVIGATION target rather than a request, like `buildAuthorizeURL` and
 * `buildEndSessionURL` beside it: the whole point of the server-side flow is
 * that the PKCE verifier is minted where JavaScript cannot see it, so the
 * browser is handed to the server rather than calling it. Hand-assembling the
 * string at the call site is what this replaces.
 *
 * Every served console sits under the shared `/console/<name>` mount, and its
 * kick is that mount's `/login/start` route. A path of its own rather than
 * `/login`, because `/login` is the console's OWN page: it is where the
 * routing guard sends a signed-out visitor and where a refused callback
 * lands with its `?error=` marker. One URL used to mean both, discriminated
 * by whether a `realmId` was present (098 C1); since the console left
 * server-core the kick can no longer fall back to serving that page, so the
 * two are separate routes.
 */
export declare function buildConsoleLoginURL(ctx: BuildConsoleLoginURLContext): string;
//# sourceMappingURL=authorization-request.d.ts.map