/**
 * Validate the PKCE parameters on an authorization request and return the
 * challenge to bind to the authorization code.
 *
 * @param {Record<string, any>} params
 * @param {{ required: boolean, redirectableState?: string }} options
 * @returns {{ codeChallenge: string }}
 */
export function resolvePkceChallenge(params: Record<string, any>, options: {
    required: boolean;
    redirectableState?: string;
}): {
    codeChallenge: string;
};
/**
 * Verify a presented `code_verifier` against the bound challenge at the
 * token endpoint. Throws `invalid_grant` on any mismatch (RFC 7636 §4.6).
 *
 * @param {string | undefined} codeVerifier
 * @param {string} boundChallenge   the challenge stored with the auth code (empty = none was bound)
 */
export function verifyCodeVerifier(codeVerifier: string | undefined, boundChallenge: string): void;