/**
 * Constant-time string comparison to prevent timing attacks.
 *
 * Uses `crypto.timingSafeEqual` with padding so both buffers always have
 * the same byte length. The actual length is checked separately to reject
 * mismatches without leaking position information.
 */
export declare function safeEqualSecret(provided: string | undefined | null, expected: string | undefined | null): boolean;