/**
 * Boot-time guard: reject an HMAC secret under 256 bits, loudly, at construction - never at the
 * first request. UTF-8 byte length (not char count), so a multibyte secret is measured honestly.
 * The single source of truth for the framework's secret-strength floor; every HMAC entry point
 * (signed cookies, `@nifrajs/auth` sessions, webhook verification, signed upload/image URLs) routes
 * its secret through here so the bar can't drift between them.
 */
export declare function requireSecretBytes(secret: string | Uint8Array, label: string): void;
//# sourceMappingURL=secret.d.ts.map