/**
 * Constant-time string comparison that leaks neither length nor content through
 * timing.
 *
 * Both inputs are HMAC'd under a fresh random per-call key, so the comparison
 * runs over two fixed-length (32-byte) digests without an early return, and an
 * attacker cannot precompute or correlate the digests across calls. Use this for
 * comparing secrets (e.g. API keys) instead of `===`, which short-circuits on
 * the first differing byte.
 */
export declare function timingSafeEqual(a: string, b: string): Promise<boolean>;