import { PKCEParams } from './types.js';
export type { PKCEParams } from './types.js';
/**
 * PKCE (Proof Key for Code Exchange) Utilities
 * Implements RFC 7636
 *
 * PKCE is REQUIRED by OAuth 2.1 to prevent authorization code interception attacks
 */
/**
 * Generate a cryptographically secure random code verifier
 *
 * Per RFC 7636:
 * - code_verifier = high-entropy cryptographic random STRING
 * - using unreserved characters [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~"
 * - minimum length of 43 characters and maximum length of 128 characters
 */
export declare function generateCodeVerifier(): string;
/**
 * Generate code challenge from code verifier
 *
 * @param codeVerifier - The code verifier string
 * @param method - Challenge method: 'S256' (SHA-256) or 'plain'
 */
export declare function generateCodeChallenge(codeVerifier: string, method?: 'S256' | 'plain'): string;
/**
 * Generate complete PKCE parameters
 *
 * @param method - Challenge method (defaults to S256 as required by OAuth 2.1)
 * @returns PKCEParams with verifier and challenge
 */
export declare function generatePKCEParams(method?: 'S256' | 'plain'): PKCEParams;
/**
 * Verify PKCE challenge
 * Used by authorization servers to verify the code_verifier matches the code_challenge
 *
 * @param codeVerifier - The code verifier from token request
 * @param codeChallenge - The code challenge from authorization request
 * @param method - The challenge method used
 * @returns true if verification succeeds
 */
export declare function verifyPKCE(codeVerifier: string, codeChallenge: string, method: 'S256' | 'plain'): boolean;
/**
 * Validate code verifier format
 * Per RFC 7636: [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~"
 * Length: 43-128 characters
 */
export declare function isValidCodeVerifier(verifier: string): boolean;
/**
 * Validate PKCE method support
 * OAuth 2.1 REQUIRES S256 when technically capable
 */
export declare function validatePKCESupport(supportedMethods: string[] | undefined): boolean;
//# sourceMappingURL=pkce.d.ts.map