/**
 * @param {string} prefix
 * @param {string} name
 * @param {(msg: string) => Error} invalidArg
 * @returns {string}
 */
export function assertPrefix(prefix: string, name: string, invalidArg: (msg: string) => Error): string;
/**
 * Mint the raw pieces of a new key. Returns the wire token, the
 * plaintext id (for DB lookup), and the storage hash of the secret.
 *
 * @param {string} prefix
 * @param {Buffer | null} pepper   Newest pepper, or null when unconfigured.
 * @returns {{ key: string, id: string, hash: string }}
 */
export function mint(prefix: string, pepper: Buffer | null): {
    key: string;
    id: string;
    hash: string;
};
/**
 * Compute the storage hash of a raw secret. With a pepper: HMAC-SHA256
 * keyed by the pepper. Without: plain SHA-256. Both return the digest
 * as a 43-char base64url string.
 *
 * @param {Buffer} secretBytes
 * @param {Buffer | null} pepper
 * @returns {string}
 */
export function hashSecret(secretBytes: Buffer, pepper: Buffer | null): string;
/**
 * Timing-safe compare of a candidate hash against a stored hash. Both
 * inputs are base64url strings. A length mismatch early-returns `false`
 * — all stored hashes are fixed-length (43-char SHA-256 digests), so
 * the length check leaks no information about the stored value.
 *
 * @param {string} candidate
 * @param {string} stored
 * @returns {boolean}
 */
export function hashesMatch(candidate: string, stored: string): boolean;
/**
 * Parse a raw key without verifying it. Returns the segments, or
 * `null` when the shape is wrong. Never throws.
 *
 * Callers can use `parseApiKey(key).prefix` to route by key family
 * in a middleware before hitting the store — but the parse result
 * MUST NOT be trusted as authenticated. Only `verifyApiKey` proves
 * the holder possesses the real secret.
 *
 * @param {string} key
 * @returns {{ prefix: string, id: string, secret: string } | null}
 */
export function parseApiKey(key: string): {
    prefix: string;
    id: string;
    secret: string;
} | null;
/**
 * Compute the storage hash for a candidate raw key's secret half,
 * trying peppers newest-first. Returns the hash + which pepper matched
 * (or null if no pepper array was supplied).
 *
 * Used by `verifyApiKey` — it hashes the incoming secret with each
 * pepper in the rotation and lets the caller decide which one to
 * compare against. The needsRehash signal (secret matched an older
 * pepper) is exposed to consumers so they can silently upgrade
 * storage on the next successful auth.
 *
 * @param {string} rawSecret     The base64url secret segment.
 * @param {Buffer[] | null} peppers
 * @returns {{ candidateHashes: string[] }}
 */
export function candidateHashesFor(rawSecret: string, peppers: Buffer[] | null): {
    candidateHashes: string[];
};
/**
 * Log-safe display for a key. Returns `<prefix>_<first-N-of-id>…<last-M-of-secret>`
 * so the value is recognisable in an audit log without disclosing the
 * secret. The default masks all but the first 6 chars of the id and
 * the last 4 chars of the secret.
 *
 * @param {string} key
 * @returns {string}
 */
export function mask(key: string): string;
export const _nodeTimingSafeEqual: any;
export const _isBytes: typeof isBytes;
import { isBytes } from '@exortek/shared/predicates';