/**
 * API token generation and hashing utilities.
 *
 * Tokens use the format `secret_fuz_token_<base64url>` and are stored
 * as blake3 hashes. These are pure cryptographic operations with no
 * framework dependency — the bearer auth middleware that validates
 * tokens lives in `auth/bearer_auth.ts`.
 *
 * @module
 */
import { z } from 'zod';
/** Prefix for all fuz API tokens (enables secret scanning). */
export declare const API_TOKEN_PREFIX = "secret_fuz_token_";
/**
 * Regex for the public API token id (e.g. `tok_abC0_d-3xyzA`). Twelve
 * base64url characters after the `tok_` prefix. Matches the format produced
 * by `generate_api_token`.
 */
export declare const API_TOKEN_ID_REGEX: RegExp;
/** Zod schema for the public API token id. */
export declare const ApiTokenId: z.ZodString;
export type ApiTokenId = z.infer<typeof ApiTokenId>;
/**
 * Hash an API token for storage using blake3.
 *
 * @param token - the raw API token
 * @returns hex-encoded blake3 hash
 */
export declare const hash_api_token: (token: string) => string;
/**
 * Generate a new API token with its hash and public id.
 *
 * The raw token is returned exactly once — callers must present it
 * to the user immediately.
 *
 * @returns the raw token, a public id, and the blake3 hash for storage
 */
export declare const generate_api_token: () => {
    token: string;
    id: string;
    token_hash: string;
};
//# sourceMappingURL=api_token.d.ts.map