/** Constant-time string comparison using HMAC to prevent timing side-channel attacks.
 *  HMAC digests are always 32 bytes, so comparison is constant-time regardless of input lengths. */
export declare function safeTokenCompare(a: string, b: string): boolean;