/** Generate a 32-byte random hex token for per-boot bearer auth. */
export declare function generateBearerToken(): string;
/**
 * Constant-time token comparison. Returns false for length mismatches (length
 * is not secret in this protocol, so leaking it via early exit is acceptable).
 */
export declare function bearerTokensEqual(a: string, b: string): boolean;
/**
 * Extract the token from an `Authorization: Bearer <token>` header value.
 * Returns undefined when the header is absent or not a bearer credential.
 */
export declare function readAuthorizationBearer(authorization: string | undefined): string | undefined;
//# sourceMappingURL=bearer.d.ts.map