import { PKCECookiePayload, State } from './interfaces.js';
export declare const PKCE_COOKIE_NAME = "wos-auth-verifier";
/**
 * Derive a flow-specific cookie name so concurrent auth flows don't overwrite
 * each other's PKCE cookies.
 */
export declare function getPKCECookieNameForState(state: string): string;
/**
 * Build a `Set-Cookie` header string for the PKCE verifier cookie.
 *
 * `SameSite=Strict` would be stripped on the cross-site redirect back from
 * WorkOS, so it is set to `Lax` — the minimum that survives a top-level
 * cross-site navigation back to our origin.
 *
 * Callers that have the incoming `Request` in hand should pass it via
 * `options.request` so the `Secure` attribute reflects the actual protocol
 * in use rather than the configured redirect URI's — otherwise running
 * `npm run dev` on http:// while `WORKOS_REDIRECT_URI=https://…` would mint
 * a `Secure` cookie the browser silently drops.
 */
export declare function getPKCECookieString(sealedState: string, options?: {
    value?: string;
    expired?: boolean;
    request?: Request;
    secure?: boolean;
    redirectUri?: string;
}): string;
/**
 * Read the PKCE cookie value for a given OAuth state from a Cookie header.
 * Returns `undefined` when the browser didn't send back the cookie (which
 * indicates either a brand-new user, a stolen authorization URL, or an
 * unrelated cross-site redirect — all of which are CSRF-failure conditions).
 */
export declare function readPKCECookie(cookieHeader: string | null, state: string): string | undefined;
/**
 * Build a `Set-Cookie: <name>=; Max-Age=0` string for every PKCE verifier
 * cookie on the incoming request. Used on sign-out so abandoned flows
 * (tabs closed mid-OAuth, etc.) don't leave orphan `wos-auth-verifier-*`
 * cookies accumulating under the browser's per-domain cookie cap.
 */
export declare function getPKCECleanupCookieStrings(cookieHeader: string | null, options?: {
    request?: Request;
    secure?: boolean;
    redirectUri?: string;
}): string[];
/**
 * Unseal the OAuth `state` URL parameter into its (non-secret) payload: the
 * flow `nonce`, plus any caller-supplied custom state and return pathname.
 *
 * Throws if the state was tampered with or encrypted under a different
 * password. Runtime validation via valibot is an acceptable tradeoff here —
 * this is not a hot path, and sealing/unsealing does not prove the unsealed
 * payload has the expected shape.
 */
export declare function getStateFromUrlValue(sealedState: string): Promise<State>;
/**
 * Unseal the HttpOnly PKCE cookie into the code verifier and its bound nonce.
 *
 * Throws if the cookie was tampered with, encrypted under a different
 * password, or is missing required fields — which is exactly what happens when
 * a caller replays a leaked `state` value as the cookie: it unseals to the
 * state payload (no `codeVerifier`) and fails schema validation here.
 */
export declare function getVerifierFromPKCECookieValue(cookieValue: string): Promise<PKCECookiePayload>;