/**
 * PKCE, in the four lines it actually takes.
 *
 * The verifier is the only secret in the flow: it never leaves this process, so an intercepted auth
 * code cannot be redeemed by whoever intercepted it. Three properties matter and all three are
 * tested rather than asserted:
 *
 *   FRESH PER ATTEMPT, from `randomBytes`. A verifier derived from a timestamp, a username or a
 *   fixed salt is guessable, and one reused across attempts means a leaked code from attempt one is
 *   redeemable during attempt two.
 *
 *   NEVER LOGGED OR PUT IN A URL. Nothing here returns the verifier except `createPkcePair`, and
 *   the URL builder in `endpoints.ts` accepts a challenge only, so a caller cannot pass the
 *   verifier into an authorize URL by mistake.
 *
 *   S256, ALWAYS. `plain` sends the verifier itself on the authorize URL, where it lands in browser
 *   history, proxy logs and request logs. The consent screen lets the user pick "Show me a code"
 *   even on a loopback flow, so a code can always end up in human hands: S256 is sent on every
 *   flow, not only the out-of-band one.
 */
export interface PkcePair {
    /** Secret. Stays in this process until the exchange. */
    readonly verifier: string;
    /** Public. Safe on an authorize URL. */
    readonly challenge: string;
    /** Public. Compared against the callback's `state` in constant time. */
    readonly state: string;
}
export declare function base64Url(buffer: Buffer): string;
/** `base64url(sha256(verifier))` with no padding, which is what S256 means. */
export declare function challengeFor(verifier: string): string;
/**
 * A verifier, its challenge, and a fresh state.
 *
 * @param random - Injectable only so a test can prove the values come from the RNG it was given.
 *                 Production callers pass nothing.
 */
export declare function createPkcePair(random?: (size: number) => Buffer): PkcePair;
/**
 * Compare the echoed state against the one we sent, in constant time.
 *
 * Length is checked first because `timingSafeEqual` throws on a length mismatch, and a thrown
 * exception is not a security decision -- it is a crash in the middle of an authorization.
 */
export declare function stateMatches(expected: string, received: string | null): boolean;
//# sourceMappingURL=pkce.d.ts.map