// engine/auth/pkce.ts — PKCE challenge/verifier generation (SPEC-161)
// Uses Node.js built-in crypto — no external dependencies.
// Implements S256 method as required by OAuth 2.1.
import { randomBytes, createHash } from 'node:crypto';
const VERIFIER_LENGTH_BYTES = 32; // 32 bytes → 43-char base64url (RFC 7636 §4.1: 43-128 chars)
/**
 * Generate a random code verifier (URL-safe base64, no padding).
 * The verifier is kept secret by the client and sent at the token exchange step.
 */
export function generateCodeVerifier() {
    return randomBytes(VERIFIER_LENGTH_BYTES).toString('base64url');
}
/**
 * Derive the S256 code challenge from a verifier.
 * challenge = BASE64URL(SHA-256(ASCII(verifier)))
 */
export function deriveCodeChallenge(verifier) {
    return createHash('sha256').update(verifier, 'ascii').digest('base64url');
}
/**
 * Generate a complete PKCE challenge pair (verifier + S256 challenge).
 * Both values are URL-safe base64 without padding.
 */
export function generatePkceChallenge() {
    const codeVerifier = generateCodeVerifier();
    const codeChallenge = deriveCodeChallenge(codeVerifier);
    return {
        codeVerifier,
        codeChallenge,
        codeChallengeMethod: 'S256',
    };
}
//# sourceMappingURL=pkce.js.map