import type { StoredOAuthState } from "./types.js";
export declare const DEFAULT_OAUTH_STATE_TTL_MS: number;
export declare const DEFAULT_OAUTH_STATE_CLOCK_SKEW_MS: number;
export declare const MAX_OAUTH_STATE_KEY_LENGTH = 1024;
/** A legacy-compatible state row after all current security fields are proven. */
export type NormalizedStoredOAuthState = StoredOAuthState & {
    redirectUri: string;
    scopes: string[];
};
/** Normalize an authenticated identity before it is used in a persistent key. */
export declare function normalizeOAuthUserId(value: unknown): string | null;
export declare function isFreshOAuthStateTimestamp(createdAt: unknown, now?: number, ttlMs?: number, clockSkewMs?: number): createdAt is number;
/** Copy state before storing or returning it so caller mutation cannot alter ownership. */
export declare function cloneStoredOAuthState<T extends StoredOAuthState>(state: T): T;
/** Validate a state row returned by an application-provided persistent store. */
export declare function normalizeStoredOAuthStateForStorage(value: unknown, now?: number, ttlMs?: number, clockSkewMs?: number): NormalizedStoredOAuthState | null;
/** Validate a consumed row and enforce its transaction-specific bindings. */
export declare function normalizeStoredOAuthState(value: unknown, expectedServiceId: string, expectedRedirectUri: string, now?: number, requireCodeVerifier?: boolean): NormalizedStoredOAuthState | null;
//# sourceMappingURL=state-utils.d.ts.map