// src/engine/oauth/pkce.ts — PKCE helpers for OAuth 2.0 (SPEC-440)
import { randomBytes, createHash } from 'node:crypto';
/**
 * Generate a cryptographically random PKCE code verifier (43-128 chars, URL-safe).
 * Uses base64url encoding without padding.
 */
export function generateCodeVerifier() {
    // 32 bytes → 43 base64url chars (within the 43-128 allowed range)
    return randomBytes(32).toString('base64url');
}
/**
 * Derive a PKCE code challenge from a verifier using SHA-256 + base64url.
 * This is the S256 method required by RFC 7636.
 */
export function generateCodeChallenge(verifier) {
    return createHash('sha256').update(verifier).digest('base64url');
}
//# sourceMappingURL=pkce.js.map