/**
 * Proof Key for Code Exchange (PKCE) — RFC 7636.
 *
 * PKCE hardens the OAuth 2.0 authorization-code flow for public clients that
 * cannot keep a secret. The client mints a high-entropy random `code_verifier`,
 * derives a `code_challenge` from it, and sends only the challenge on the
 * authorization request. At the token endpoint it presents the verifier; the
 * server re-derives the challenge and checks it matches, proving the same client
 * that started the flow is finishing it.
 *
 * This module implements the S256 transformation defined in RFC 7636 §4:
 *
 *   code_verifier  = high-entropy string, 43–128 chars from the unreserved set
 *                    [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~"   (§4.1)
 *   code_challenge = BASE64URL-ENCODE( SHA256( ASCII(code_verifier) ) )   (§4.2)
 *
 * Everything runs on the Web Crypto API (`crypto.getRandomValues`,
 * `crypto.subtle.digest`), available as a global in Node 20+.
 */
/** The S256 challenge method. RFC 7636 §4.3 — the only method we emit. */
export type PkceMethod = "S256";
/**
 * A PKCE pair ready to drive an authorization-code flow.
 *
 * `verifier` is kept by the client and sent only at token exchange; `challenge`
 * and `method` travel on the initial authorization request.
 */
export interface PkcePair {
    readonly verifier: string;
    readonly challenge: string;
    readonly method: PkceMethod;
}
/**
 * Generate a `code_verifier`: `length` characters drawn uniformly from the
 * unreserved set using CSPRNG bytes. Rejection sampling keeps the distribution
 * unbiased across the 66-character alphabet.
 *
 * @param length characters to emit; clamped into the RFC's [43, 128] range.
 */
export declare function createCodeVerifier(length?: number): string;
/**
 * Derive the S256 `code_challenge` for a verifier:
 * `BASE64URL( SHA-256( ASCII(verifier) ) )` (RFC 7636 §4.2).
 */
export declare function deriveCodeChallenge(verifier: string): Promise<string>;
/**
 * Create a complete PKCE pair: a fresh verifier plus its S256 challenge.
 *
 * @param verifierLength optional verifier length; defaults to 64, clamped to
 *                       the RFC's 43–128 range.
 */
export declare function createPkcePair(verifierLength?: number): Promise<PkcePair>;
