/**
 * `@platform-modules/util/crypto` — AES-GCM secrets, SHA-256 hex, portable timing-safe compare.
 *
 * `timingSafeEqual` is safe only for equal-expected-length comparands (hashes, tokens).
 * The length guard returns early — do not use for variable-length secrets.
 */
/**
 * Portable constant-time string comparison (NOT `crypto.subtle.timingSafeEqual` — CF-only).
 * Safe only when `a` and `b` are expected to be the same length (e.g. hex hashes).
 */
declare function timingSafeEqual(a: string, b: string): boolean;
/** AES-256-GCM — returns base64( iv(12B) ‖ ciphertext+tag ). IV is random per call. */
declare function encryptSecret(plaintext: string, keyB64: string): Promise<string>;
/** Decrypts base64( iv(12B) ‖ ciphertext+tag ). Throws on tamper, wrong key, or malformed input. */
declare function decryptSecret(blob: string, keyB64: string): Promise<string>;
/** SHA-256 hex digest of `input`. */
declare function sha256(input: string): Promise<string>;
/** URL-safe base64 without padding (`+`→`-`, `/`→`_`). */
declare function base64url(bytes: ArrayBuffer | Uint8Array): string;
/**
 * HMAC-SHA-256 of `message` under `secret`, returned as URL-safe base64 (no padding).
 * Fail-closed on minting: throws on an empty `secret` rather than signing under a weak key.
 */
declare function hmacSign(message: string, secret: string): Promise<string>;
/**
 * Constant-time verify of an `hmacSign` signature over `message` under `secret`.
 * Fail-closed: returns false on an empty `secret` or any mismatch — never throws.
 * Comparison is timing-safe (recompute-and-compare via {@link timingSafeEqual}).
 */
declare function hmacVerify(message: string, secret: string, signature: string): Promise<boolean>;

export { base64url, decryptSecret, encryptSecret, hmacSign, hmacVerify, sha256, timingSafeEqual };