/**
 * OAuth 2.0 + PKCE (RFC 7636) client-side generation (ADR-306).
 *
 * A TypeScript port of meta-proxy's `src/oauth/pkce.rs` (cognitum-one/meta-proxy,
 * itself ported from `dashboard/apps/cli/src/pkce.rs`) so a verifier generated
 * here validates against the same `services/identity` authorization server
 * meta-proxy already talks to successfully — same byte lengths, same encoding,
 * same hash. Intentionally duplicated rather than imported from
 * `@claude-flow/mcp/src/oauth.ts` (a different, unrelated OAuth client in this
 * monorepo) — ADR-306 assigns PKCE ownership to this package specifically.
 *
 * @module v3/security/oauth/pkce
 */
export interface PkceRequest {
    state: string;
    codeVerifier: string;
    codeChallenge: string;
}
export declare function challengeFromVerifier(verifier: string): string;
/**
 * Generates a fresh `state` + PKCE verifier/challenge pair for one login
 * attempt.
 */
export declare function generate(): PkceRequest;
//# sourceMappingURL=pkce.d.ts.map