If we want to have thorough preconditions checking, we need to also verify that the length of availableSigns isn't greater than numberOfPossibleByteValues.

It might be a good idea to add a comment explaining why we're using this value. Also, shouldn't we take a floor of this?

We should avoid using duplicated values if there's a connection between them. Here we're comparing with numberOfPossibleByteValues so this value should be used instead of the hardcoded one.

Please take care of the line length.

To make it more readable we can use repeat function of string

Please add an empty line after @flow

It looks like importing crypto, which is a node module, works because it gets polyfilled. The curious thing is that no action was taken on our side to make this working. This happened because in webpack 4 the default configuration https://v4.webpack.js.org/configuration/node/ is global: true which means that node globals were polyfilled by default. This could also means that we were already including this code in our builds (unless some tree shakings were performed).
In webpack 5 https://webpack.js.org/configuration/node/ this defaults change to global: false, so during the upgrade we would need to either set it to true or find some alternative solution.

I guess my comment was confusing. Taking floor of validByteUpperBound / numberOfPossibleByteValues doesn't make sense as it is almost always less than 1. We should instead take a floor of the whole expression.