import type { Settings } from "@opengeni/config";
import type { AccessGrant } from "@opengeni/contracts";
import type { GitHubSignedStatePayload } from "@opengeni/github";
/**
 * Bounded configured-token browser handoff. These signed claims preserve only
 * the exact OpenGeni github:manage grant across GitHub redirects; the callback
 * independently proves current GitHub personal/organization ownership. This
 * state must never be interpreted as GitHub installation authority.
 */
export declare const githubBrowserGrantMaxAgeSeconds: number;
export declare function githubBrowserGrantClaims(settings: Pick<Settings, "productAccessMode">, grant: AccessGrant, nowSeconds?: number): Record<string, unknown>;
export declare function continuedGitHubBrowserGrantClaims(payload: GitHubSignedStatePayload): Record<string, unknown>;
/**
 * GitHub may return only to the session that initiated setup. This rejects
 * absolute/protocol-relative URLs and paths for another workspace before the
 * value is signed into provider state.
 */
export declare function githubSessionReturnPath(value: string | undefined | null, workspaceId: string): string | null;
export declare function githubBrowserGrantFromState(settings: Pick<Settings, "productAccessMode">, payload: GitHubSignedStatePayload, workspaceId: string, nowSeconds?: number): AccessGrant | null;
export declare function githubBrowserBaseUrl(settings: Pick<Settings, "githubAppManifestBaseUrl" | "publicBaseUrl">, requestOrigin?: string | null): string;