/**
 * Dual Bearer / Basic auth guard for admin endpoints.
 *
 * Motivating shape: you want scripts / CI to hit /admin/* with `Authorization:
 * Bearer <api-key>` and humans to hit the same routes from a browser (which
 * pops a native login prompt via HTTP Basic). Both paths compare in constant
 * time via `timingSafeStringEqual` to avoid credential-length leaks.
 *
 *   const guard = requireAdminAuth(req, {
 *     bearerKey: env.ADMIN_API_KEY,
 *     basicUser: env.ADMIN_USER,
 *     basicPass: env.ADMIN_PASS,
 *   });
 *   if (guard) return guard;         // 401 with WWW-Authenticate
 *   // authorized — continue handling the request
 *
 * All three credentials are optional: if none are configured, every request
 * is denied. That's intentional — a misconfigured admin surface is a bigger
 * risk than a hard 401.
 */
export interface AdminAuthConfig {
    bearerKey?: string | null;
    basicUser?: string | null;
    basicPass?: string | null;
    /** Advertised realm in the WWW-Authenticate header. Default: `admin`. */
    realm?: string;
}
/**
 * Returns `null` if the request presents valid Bearer OR Basic credentials.
 * Otherwise returns a 401 Response with `WWW-Authenticate: Basic realm="..."`
 * so browsers pop the native login prompt.
 */
export declare function requireAdminAuth(req: Request, config: AdminAuthConfig): Response | null;
/**
 * Constant-time string comparison. Both inputs are coerced to strings first;
 * length inequality returns `false` fast (this leaks length, which is fine
 * for API keys / passwords where length is not the secret).
 */
export declare function timingSafeStringEqual(a: string, b: string): boolean;
//# sourceMappingURL=admin_auth.d.ts.map