/**
 * src/oauth/pkce.ts — PKCE (Proof Key for Code Exchange) utilities.
 *
 * Implements RFC 7636 S256 challenge verification and cryptographically
 * random authorization code generation.
 */
/**
 * Verify that `code_challenge === base64url(SHA-256(code_verifier))`.
 *
 * Uses crypto.timingSafeEqual for the final comparison to prevent
 * timing side-channel attacks.
 */
export declare function verifyCodeChallenge(code_verifier: string, code_challenge: string): boolean;
/**
 * Generate a cryptographically random authorization code.
 * Returns 64 hex characters (32 random bytes).
 */
export declare function generateAuthorizationCode(): string;