/**
 * Derive a CSRF token from a session ID + a server-side secret. The
 * output is a base64url string safe for cookies, form fields, and JSON
 * bodies.
 *
 * @param {string} sessionId
 * @param {string | Buffer | Uint8Array} secret
 * @returns {string}
 */
export function deriveCsrfToken(sessionId: string, secret: string | Buffer | Uint8Array): string;
/**
 * Constant-time verify a candidate CSRF token against a session ID +
 * secret pair. Returns `false` on any mismatch, including malformed
 * input — never throws for user-supplied values.
 *
 * @param {unknown} candidate
 * @param {string} sessionId
 * @param {string | Buffer | Uint8Array} secret
 * @returns {boolean}
 */
export function verifyCsrfToken(candidate: unknown, sessionId: string, secret: string | Buffer | Uint8Array): boolean;
/**
 * One-time-pad mask a CSRF token for embedding in compressed HTML
 * (BREACH mitigation, per OWASP). Output is `base64url(pad ‖ pad⊕token)`
 * — a fresh random pad per call, so two renders of the same token never
 * produce the same bytes.
 *
 * @param {string} token    Output of {@link deriveCsrfToken}.
 * @returns {string}
 */
export function maskCsrfToken(token: string): string;
/**
 * Reverse {@link maskCsrfToken}. Returns the underlying token, or
 * `null` for malformed input — never throws for user-supplied values.
 * Feed the result into {@link verifyCsrfToken}.
 *
 * @param {unknown} masked
 * @returns {string | null}
 */
export function unmaskCsrfToken(masked: unknown): string | null;