/**
 * Generate cryptographically secure state parameter for CSRF protection
 *
 * The state parameter is used to prevent CSRF attacks by ensuring the
 * callback request originated from our initiate request.
 *
 * @returns Random 32-byte hex string
 */
export declare function generateState(): string;
/**
 * Generate cryptographically secure session ID
 *
 * @returns Random 16-byte hex string
 */
export declare function generateSessionId(): string;
/**
 * Generate cryptographically secure nonce for ID token replay protection
 *
 * The nonce is included in the authorization request and must be present
 * in the ID token claims to prevent replay attacks.
 *
 * @returns Random 16-byte hex string
 */
export declare function generateNonce(): string;
/**
 * Validate state parameter using constant-time comparison
 *
 * Uses timing-safe comparison to prevent timing attacks that could
 * reveal information about the expected state value.
 *
 * @param providedState - State from callback request
 * @param expectedState - State from session
 * @returns true if states match, false otherwise
 */
export declare function validateState(providedState: string, expectedState: string): boolean;
//# sourceMappingURL=state-utils.d.ts.map