import type { TokenValidationResult, AuthConfig } from '../../types/index.js';
/**
 * Extract the raw token from an Authorization header value.
 * Returns null if the header is missing or not a Bearer token.
 */
export declare function extractBearerToken(authorizationHeader: string | undefined): string | null;
/**
 * Validate an access token against the configured OAuth provider.
 * Prefers JWKS validation (offline) when jwksUrl is configured,
 * falls back to introspection endpoint (online) when introspectionUrl is set.
 *
 * IMPORTANT: The token string is NEVER logged or included in error messages.
 */
export declare function validateToken(token: string, config: AuthConfig): Promise<TokenValidationResult>;
//# sourceMappingURL=token-validator.d.ts.map