/** Options for `buildAuthorizationURL`. */
export interface BuildAuthorizationURLOptions {
    /** Authorization endpoint resolved from OIDC discovery. */
    authorizationEndpoint: string;
    /** OAuth client identifier registered with the authorization server. */
    clientId: string;
    /** Loopback redirect URI the callback server is listening on. */
    redirectURI: string;
    /** PKCE `code_challenge` derived via S256. */
    codeChallenge: string;
    /** CSRF `state` value, echoed by the auth server and validated on callback. */
    state: string;
    /** OAuth scopes to request. No default; callers choose explicitly. */
    scopes: readonly string[];
}
/**
 * Builds the OAuth authorization URL (RFC 6749 §4.1.1 + RFC 7636 §4.3)
 * that the user's browser is sent to. Non-OAuth params already present
 * on the authorization endpoint (e.g. Keycloak's `kc_idp_hint`) pass
 * through unchanged. Throws if the endpoint already carries any of the
 * OAuth-required params — that collision is a server misconfiguration
 * we refuse to paper over.
 */
export declare function buildAuthorizationURL(options: BuildAuthorizationURLOptions): string;