/**
 * Crypto helpers exposed to pipeline function handlers as the global `utils`
 * (also passed on the handler argument, so both `utils.sign(...)` and
 * `function handler({ utils }) { ... }` work).
 *
 * Mirrors `PipelineFunctionUtils` in the CE runtime
 * (apps/backend/src/pipelines/function-runner.service.ts, ~22-176). All helpers
 * are pure `string -> string | boolean`, coerce inputs with `String()`, and
 * never throw on bad input.
 */
export interface HandlerUtils {
    /** Lowercase hex SHA-256 of `message`. */
    sha256(message: string): string;
    /** Lowercase hex HMAC-SHA256 of `message` with the caller-supplied `key`. */
    hmacSha256(message: string, key: string): string;
    /** Hex HMAC-SHA256 of `message` using the harness signing key. */
    sign(message: string): string;
    /** Timing-safe check that `signature` matches `sign(message)`. */
    verify(message: string, signature: string): boolean;
    /** Crypto-strong random hex token of `bytes` length (default 18 -> 36 hex chars). */
    randomToken(bytes?: number): string;
    /** RFC4122 v4 UUID. */
    randomUUID(): string;
    /** Base64url-encode a UTF-8 string (no padding). */
    base64urlEncode(value: string): string;
    /** Decode a base64url string back to a UTF-8 string ('' on malformed input). */
    base64urlDecode(value: string): string;
}
/**
 * Build the `utils` crypto bag injected into every handler sandbox.
 *
 * @param signingSecret - Base secret keying `sign`/`verify`
 *   (defaults to {@link DEFAULT_HARNESS_SECRET}).
 */
export declare function createUtils(signingSecret?: string): HandlerUtils;