createPkcePair (auth/pkce.ts)

* RFC 7636 (PKCE, S256) using the Web Crypto API — no dependency. PKCE is what lets a browser be an OAuth client with NO SECRET. The client generates a random verifier, sends only its SHA-256 hash to start the flow, and presents the verifier when redeeming the code. An attacker w

// Source: https://github.com/panaversity/ksor | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * RFC 7636 (PKCE, S256) using the Web Crypto API — no dependency.
 *
 * PKCE is what lets a browser be an OAuth client with NO SECRET. The client
 * generates a random verifier, sends only its SHA-256 hash to start the flow,
 * and presents the verifier when redeeming the code. An attacker who steals the
 * authorization code cannot redeem it without the verifier, which never left
 * the browser that started the flow.
 *
 * That is the whole reason this site needs no server: there is nothing to keep
 * secret, so there is nothing that must live somewhere the reader cannot see.
 */



... (truncated -- full source via MCP)