/**
 * Utility Functions
 */
/**
 * SHA-256 hex digest aligned with the worker's CAPI hashing (cloudflare/
 * postback/core/utils.js `sha256()`). Always lowercases + trims the input
 * before hashing — Meta's matching requires byte-for-byte identical hashes
 * on the Pixel side and the CAPI server side, and the worker uniformly
 * normalizes everything it hashes (em, ph, fn, ln, external_id, etc).
 *
 * Pixel-side hashes that don't match CAPI hashes silently fail to dedupe,
 * which is why this helper does the normalization for callers — easy to
 * forget, hard to debug after release. Returns null when Web Crypto isn't
 * available (very old browsers, non-secure contexts) so callers can
 * gracefully skip advanced matching rather than throwing.
 */
export declare function sha256Hex(input: string): Promise<string | null>;
/**
 * Generate UUID v4
 */
export declare function generateUUID(): string;
/**
 * Get URL query parameter
 */
export declare function getQueryParam(name: string, search?: string): string | null;
/**
 * Get all URL query parameters
 */
export declare function getAllQueryParams(search?: string): Record<string, string>;
/**
 * Sanitize event data (remove sensitive keys, DOM elements, functions)
 */
export declare function sanitizeEventData(data: any, maxDepth?: number, currentDepth?: number): any;
/**
 * Redact secret/PII param VALUES in a URL (9.A.4). The param NAME is kept
 * (value → `__redacted__`) so funnel steps that match on the param's presence still
 * work; every other param — click IDs (fbclid/gclid/…) and utm_* — survives untouched.
 * Both the query string AND a k=v fragment are rewritten: TR-04 — OAuth-implicit /
 * Supabase magic links carry the session in the FRAGMENT (`/welcome#access_token=eyJ…`),
 * with no query string at all; the old code returned early on a missing `?` and reattached
 * the fragment verbatim, leaking the full JWT into `url` / `landingPage` / `dl_first_touch`
 * (90d) and onward to ad platforms. Non-k=v fragments (`#section`, `#/spa-route`) keep their
 * shape. Returns the input unchanged when nothing sensitive matched or on any parse
 * failure — redaction must never break tracking.
 */
export declare function redactUrl(url: string): string;
/**
 * Deep merge objects
 */
export declare function deepMerge(target: any, ...sources: any[]): any;
/**
 * Debounce function
 */
export declare function debounce<T extends (...args: any[]) => any>(func: T, wait: number): (...args: Parameters<T>) => void;
/**
 * Calculate retry delay with exponential backoff and jitter
 */
export declare function calculateRetryDelay(attempt: number, baseDelay?: number): number;
/**
 * Check if browser Do Not Track is enabled
 */
export declare function isDoNotTrackEnabled(): boolean;
/**
 * Check if Global Privacy Control is enabled
 */
export declare function isGlobalPrivacyControlEnabled(): boolean;
/**
 * Registrable domain (eTLD+1) for a hostname, honoring two-part ccTLDs.
 *   shop.example.co.uk → example.co.uk
 *   www.example.com    → example.com
 *   localhost / IPs    → returned unchanged
 * Returns a bare host (no leading dot) — getRootDomain() adds the cookie-domain dot.
 * (FSR-47: same-site referrer classification must use this, not naive last-two-labels.)
 */
export declare function getRegistrableDomain(hostname: string): string;
/**
 * Get root domain for cross-subdomain tracking (cookie-domain form, with leading dot).
 */
export declare function getRootDomain(): string;
/**
 * Get referrer data
 */
export declare function getReferrerData(): Record<string, any>;
//# sourceMappingURL=utils.d.ts.map