export declare function requireEncryptionKey(env: object): string;
export declare function randomToken(byteLength?: number): string;
/** Hashes a short-lived bearer value before it is persisted. */
export declare function hashToken(value: string): Promise<string>;
/** Returns `base64(iv || ciphertext)`. */
export declare function encryptSecret(encryptionKey: string, plaintext: string): Promise<string>;
export declare function decryptSecret(encryptionKey: string, encoded: string): Promise<string>;
export type PkcePair = {
    verifier: string;
    challenge: string;
};
export declare function createPkcePair(): Promise<PkcePair>;
/** Length-independent comparison, to keep API-key checks off the timing side channel. */
export declare function safeEqual(left: string, right: string): boolean;
//# sourceMappingURL=crypto.d.ts.map