import type { GetAuthURLOptions, GetAuthURLResult } from './interfaces.js';
/**
 * Build an AuthKit authorization URL and the PKCE / CSRF cookie that must
 * travel back with the user on the cross-site redirect.
 *
 * The caller attaches the returned `headers` to their redirect response:
 *
 * ```ts
 * const { url, headers } = await getAuthorizationUrl({ returnPathname: '/dashboard' });
 * return redirect(url, { headers });
 * ```
 *
 * Internally this:
 * 1. Generates a PKCE verifier / challenge pair (RFC 7636, S256).
 * 2. Seals `{ nonce, customState, returnPathname }` (no secret) and sends it
 *    as the OAuth `state` parameter.
 * 3. Seals `{ nonce, codeVerifier }` separately and sets it as an HTTP-only,
 *    flow-specific cookie (`wos-auth-verifier-<hash>`). The `codeVerifier`
 *    lives only in this cookie, never in the URL, so the callback can:
 *      - prove the response came from a flow this browser initiated by
 *        matching the cookie's `nonce` against the URL state's `nonce`; and
 *      - recover the `codeVerifier` (from the cookie) to complete the PKCE
 *        exchange.
 *
 * Because the verifier never travels in the URL, possession of a leaked
 * callback URL alone cannot complete the exchange — the initiating browser's
 * HttpOnly cookie is required.
 */
export declare function getAuthorizationUrl(options?: GetAuthURLOptions): Promise<GetAuthURLResult>;