interface OAuthState {
    codeVerifier: string;
    provider: string;
    returnTo: string;
    createdAt: number;
    /** When true, this flow connects a credential provider for an existing user (not login). */
    connectOnly?: boolean;
    /** User ID for connect-only flows. */
    userId?: string;
    /** Credential label for connect-only flows (allows multiple per provider). */
    label?: string;
}
/**
 * Create an OAuth state parameter + PKCE code verifier.
 * The state is stored in memory and expires after 5 minutes.
 */
export declare function createOAuthState(provider: string, returnTo?: string, options?: {
    connectOnly?: boolean;
    userId?: string;
    label?: string;
}): {
    state: string;
    codeVerifier: string;
};
/**
 * Consume an OAuth state parameter (one-time use).
 * Returns null if state is unknown, expired, or already consumed.
 */
export declare function consumeOAuthState(state: string): OAuthState | null;
export {};