/**
 * Constant-time comparison helpers, shared across the auth core (JWT HMAC,
 * password-hash verify) and the CSRF double-submit check so the timing-safe
 * discipline lives in exactly one place.
 *
 * Both functions short-circuit **only** on a length mismatch; for equal
 * lengths every element is compared regardless of where the first difference
 * is, so the running time does not leak how many leading bytes/chars matched.
 */
/** Constant-time byte comparison. */
export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
/** Constant-time string comparison over UTF-16 code units. */
export declare function timingSafeEqualStrings(a: string, b: string): boolean;