/**
 * Token hashing — SHA-256 hashing with timing-safe comparison.
 *
 * Provides secure token storage by hashing plaintext tokens before
 * persisting them. Uses timing-safe comparison to prevent timing attacks
 * when verifying tokens.
 *
 * @module
 */
/**
 * Hash a plaintext token using SHA-256.
 *
 * Returns a hex-encoded hash string suitable for storage.
 */
export declare function hashToken(plaintext: string): string;
/**
 * Verify a plaintext token against a stored SHA-256 hash.
 *
 * Uses timing-safe comparison to prevent timing attacks.
 */
export declare function verifyToken(plaintext: string, storedHash: string): boolean;
/**
 * Check if a stored value looks like a SHA-256 hex hash (64 hex chars).
 *
 * Used during migration to detect whether a stored token is already
 * hashed or still plaintext.
 */
export declare function isHashedToken(value: string): boolean;
/**
 * Migrate a token: if it's plaintext, hash it. If already hashed, return as-is.
 *
 * Returns `{ hash, migrated }` — migrated is true if the value was converted.
 */
export declare function migrateToken(value: string): {
    hash: string;
    migrated: boolean;
};
