/**
 * Master-token Bearer validation.
 *
 * Extracted from an earlier in-tree master-gate middleware and HARDENED per
 * this package's contract:
 *   - SHA-256 hash both the presented token AND the configured master secret,
 *     then compare the two digests with `timingSafeEqual` (constant time).
 *   - The original middleware did a direct `token !== masterToken` string
 *     compare which is non-constant-time. This brick fixes that leak so any
 *     caller using `validateMasterBearer` inherits the safer behaviour.
 *
 * Surface:
 *   `validateMasterBearer(authHeader, masterSecret) → ValidateMasterBearerResult`
 *
 * Errors are coarse-grained on purpose — callers should not surface the exact
 * reason to remote clients beyond a generic 401/403.
 */
import type { ValidateMasterBearerResult } from "./types.js";
/**
 * Validate an `Authorization: Bearer <token>` header against a configured
 * master secret.
 *
 *   - missing header  → `{ok: false, error: "missing"}`
 *   - bad format / empty token / empty secret → `{ok: false, error: "malformed"}`
 *   - token sha256 != master sha256 (constant-time) → `{ok: false, error: "mismatch"}`
 *   - match → `{ok: true}`
 *
 * The scheme prefix match is case-insensitive (RFC 7235 §2.1) but the token
 * itself is treated as opaque bytes.
 */
export declare function validateMasterBearer(authHeader: string | undefined, masterSecret: string): Promise<ValidateMasterBearerResult>;
//# sourceMappingURL=bearer-validation.d.ts.map