/** N cryptographically-random bytes (default 32), base64url-encoded (no padding). */
declare function generateOpaqueToken(bytes?: number): string;
/** SHA-256 hex digest of `token` — the value stored in the DB. */
declare function hashToken(token: string): Promise<string>;
/** True when `token` hashes to `hash`. Timing-safe — never `===`. */
declare function verifyToken(token: string, hash: string): Promise<boolean>;

export { generateOpaqueToken, hashToken, verifyToken };