/** Generate an API key secret — 128 bits of CSPRNG entropy. */
export declare const generateApiKeySecret: () => string;
/**
 * Hash an API key secret for storage in `api_keys.key_hash`.
 *
 * The secret is a high-entropy random token rather than a user-chosen password, so a
 * single SHA-256 is sufficient — there is no dictionary to attack and nothing for a
 * memory-hard KDF to defend against. The `sha256$` prefix keeps the stored value
 * self-describing so the algorithm can change later without another breaking migration.
 */
export declare const hashApiKey: (secret: string) => string;
/** Constant-time check of a secret against a stored `key_hash`. */
export declare const verifyApiKey: (storedHash: string, secret: string) => boolean;
//# sourceMappingURL=api-key.d.ts.map