/**
 * Every short-lived, single-use auth token (email verify, password reset,
 * magic link, refresh token) follows the same shape: a high-entropy random
 * value is handed to the user (mailed, or returned in the refresh cookie),
 * and only its SHA-256 hash is ever persisted. A stolen database dump is
 * therefore never enough to impersonate a pending token.
 */
export declare function generateToken(): string;
export declare function hashToken(token: string): string;
//# sourceMappingURL=token.util.d.ts.map