export declare function randomToken(byteLength?: number): string;
export declare function sha256Hex(value: string): string;
export declare function tokenHashPrefix(tokenHash: string): string;
export declare function timingSafeEqualString(a: string, b: string): boolean;
/**
 * EVO-12 P2 (mode 3): a fresh PKCE pair for the gateway's upstream 39-auth leg.
 * The verifier is held server-side (broker pending state); the S256 challenge
 * goes on the wire to /authorize.
 */
export declare function pkceS256(): {
    verifier: string;
    challenge: string;
};
//# sourceMappingURL=crypto.d.ts.map