/**
 * Load or generate the bearer token from a file path.
 * Respects the MMA_AUTH_TOKEN env override via coreLoadAuthToken when the
 * file already exists. Falls back to generating a new token if the file does not exist.
 */
export declare function loadToken(tokenPath: string): string;
/**
 * Mint a token for `resolved`, or adopt the one already there.
 *
 * Exclusive create, not a plain write. `loadToken`'s `existsSync` above is a
 * CHECK, and a check followed by a write is a race: two daemons starting
 * together on a fresh install both see "absent", both mint a token, and the
 * loser keeps a value that is no longer in the file — so every client reading
 * the file gets 401s from it. `wx` makes exactly one process the author;
 * whoever loses reads the winner's token instead of overwriting it.
 *
 * Separated from `loadToken` so the losing branch is reachable in a test
 * without needing two real processes to collide on the same millisecond.
 */
export declare function createOrAdoptToken(resolved: string): string;
/**
 * Validate an Authorization header value (including the "Bearer " prefix).
 * Uses `crypto.timingSafeEqual` so the token comparison is constant-time.
 *
 * Returns `{ ok: true }`, or `{ ok: false, reason }` naming which check failed.
 *
 * The old wording here said it fails "without leaking which check failed", which is the opposite
 * of what it does — `reason` is precisely that, and it is the only thing the function reports
 * beyond pass/fail. The property that actually holds belongs to the CALLER:
 * `request-pipeline.ts` answers every failure with the same generic 401 and writes the reason to
 * the daemon's stderr instead. Keep it that way; the distinction is for the operator reading logs,
 * never for the client.
 */
export declare function validateAuthHeader(header: string | undefined, expected: string): {
    ok: true;
} | {
    ok: false;
    reason: 'missing' | 'malformed' | 'mismatch';
};
//# sourceMappingURL=auth.d.ts.map