import { NextRequest } from 'next/server';
import { State } from './interfaces.js';
export declare const PKCE_COOKIE_NAME = "wos-auth-verifier";
export declare const PKCE_STATE_HEADER = "x-workos-pkce-state";
export declare const PKCE_AUTHORIZATION_URL_HEADER = "x-workos-authorization-url";
/**
 * Derive a flow-specific cookie name so concurrent auth flows don't overwrite
 * each other's PKCE cookies. Uses an FNV-1a hash of the full sealed state
 */
export declare function getPKCECookieNameForState(state: string): string;
/**
 * Set the PKCE verifier cookie in server action context.
 * In middleware context, callers must set the cookie via Set-Cookie headers instead.
 */
export declare function setPKCECookie(sealedState: string): Promise<void>;
/**
 * Store pending PKCE state in internal middleware headers until the response
 * actually redirects to AuthKit. These headers are stripped before reaching the
 * browser or downstream request handlers.
 */
export declare function setPendingPKCERedirectHeaders(headers: Headers, authorizationUrl: string, sealedState: string): void;
/**
 * Only set the PKCE cookie for initial document navigations that redirect to
 * AuthKit. Fetch/XHR/RSC/prefetch requests never follow cross-origin redirects
 * to complete OAuth, so they do not need verifier cookies.
 */
export declare function appendPKCESetCookieHeader(request: NextRequest, headers: Headers, sealedState: string): void;
export declare function stripPKCESetCookieHeaders(headers: Headers): void;
export declare function isInitialDocumentRequest(request: NextRequest): boolean;
/**
 * Read and unseal the auth cookie containing PKCE code verifier and OAuth state.
 * Throws if the cookie is not in the required state
 */
export declare function getStateFromPKCECookieValue(cookieValue: string): Promise<State>;