/**
 * The `S256` transform: `BASE64URL(SHA256(ASCII(code_verifier)))`.
 *
 * @param {string} codeVerifier
 * @returns {string} the `code_challenge`
 */
export function challengeFromVerifier(codeVerifier: string): string;
/**
 * @typedef {Object} PkcePair
 * @property {string} codeVerifier         keep server-side; send at token exchange
 * @property {string} codeChallenge        send on the authorization request
 * @property {'S256'} codeChallengeMethod
 */
/**
 * Generate a fresh `code_verifier` / `code_challenge` pair.
 *
 * @returns {PkcePair}
 */
export function createPkcePair(): PkcePair;
/**
 * Recompute the challenge from a presented verifier and compare it,
 * in constant time, against the one bound to the authorization request.
 * The authorization server calls this at the token endpoint.
 *
 * @param {string} codeVerifier   presented by the client at token exchange
 * @param {string} codeChallenge  bound to the authorization code
 * @returns {boolean}
 */
export function verifyChallenge(codeVerifier: string, codeChallenge: string): boolean;
export const CODE_CHALLENGE_METHOD: "S256";
export type PkcePair = {
    /**
     * keep server-side; send at token exchange
     */
    codeVerifier: string;
    /**
     * send on the authorization request
     */
    codeChallenge: string;
    codeChallengeMethod: "S256";
};