/**
 * Module: server/auth
 *
 * Production-safe shared-secret authentication for Dominds.
 *
 * - Dev mode: always disabled.
 * - Prod mode:
 *   - DOMINDS_AUTH_KEY unset: enabled with generated key
 *   - DOMINDS_AUTH_KEY empty string: disabled
 *   - DOMINDS_AUTH_KEY non-empty: enabled with provided key verbatim
 *
 * HTTP: Authorization: Bearer <auth-key>
 * WebSocket: prefers Authorization header, otherwise accepts a token in
 * Sec-WebSocket-Protocol as "dominds-auth.<auth-key>" (plain text).
 */
import type { IncomingMessage } from 'http';
export type AuthConfig = {
    kind: 'disabled';
} | {
    kind: 'enabled';
    key: string;
    source: 'env' | 'generated';
};
export type AuthCheckResult = {
    kind: 'ok';
} | {
    kind: 'unauthorized';
    reason: 'missing' | 'invalid';
};
export declare function computeAuthConfig(params: {
    mode: 'development' | 'production';
    env: NodeJS.ProcessEnv;
}): AuthConfig;
export declare function isAuthEnabled(auth: AuthConfig): auth is Extract<AuthConfig, {
    kind: 'enabled';
}>;
export declare function getHttpAuthCheck(req: IncomingMessage, auth: AuthConfig): AuthCheckResult;
export declare function getHttpAuthCheckAllowUrlParam(req: IncomingMessage, auth: AuthConfig, requestUrl: URL): AuthCheckResult;
export declare function getWebSocketAuthCheck(req: IncomingMessage, auth: AuthConfig): AuthCheckResult;
export type ServerUrlScheme = 'http' | 'https';
export declare function formatServerOrigin(params: {
    scheme: ServerUrlScheme;
    host: string;
    port: number;
}): string;
export declare function formatAutoAuthUrl(params: {
    scheme?: ServerUrlScheme;
    host: string;
    port: number;
    authKey: string;
}): string;
