import type { IncomingMessage } from "http";
export declare class HttpAuthConfigError extends Error {
    constructor(message: string);
}
export interface HttpAuthConfig {
    /** Shared secret required as `Authorization: Bearer <token>`; null when unauthenticated mode was explicitly enabled. */
    token: string | null;
}
/**
 * Resolve auth configuration from the environment.
 *
 * - `VASPERA_HTTP_TOKEN` set → bearer auth enforced on the MCP endpoint.
 * - unset + `VASPERA_HTTP_ALLOW_UNAUTHENTICATED=true` → open mode (explicit opt-in).
 * - unset otherwise → refuse to start.
 */
export declare function resolveAuthConfig(env?: NodeJS.ProcessEnv): HttpAuthConfig;
/**
 * Check a request against the resolved config. Constant-time comparison so
 * the token cannot be recovered byte-by-byte via timing.
 */
export declare function isAuthorized(req: IncomingMessage, config: HttpAuthConfig): boolean;
//# sourceMappingURL=http-auth.d.ts.map