/**
 * PKCE (RFC 7636) helpers for the Overworld portal handoff. The destination
 * game (a public browser client) generates a verifier+challenge; the challenge
 * travels to the Overworld identity origin which mints a one-time code; the game
 * exchanges the code with the verifier. The verifier never leaves the game's
 * origin, so an intercepted code can't be redeemed.
 *
 * Uses WebCrypto + base64url, available in browsers and Node 18+.
 */
export interface PkcePair {
    verifier: string;
    challenge: string;
    method: 'S256';
}
/** Generate a fresh PKCE verifier + S256 challenge. */
export declare function generatePkcePair(): Promise<PkcePair>;
/** Opaque random state for CSRF-binding the redirect round-trip. */
export declare function generateState(): string;
//# sourceMappingURL=pkce.d.ts.map