/**
 * Bearer-token auth carried over the WebSocket subprotocol.
 *
 * The browser `WebSocket` API cannot set request headers, so the token rides in
 * `Sec-WebSocket-Protocol` instead — the one handshake field a browser client
 * can populate. The server reads it during the upgrade and rejects mismatches
 * before the socket opens.
 *
 * This module is dependency-free and runtime-neutral (only `btoa`/`atob`, which
 * are globals in Node 16+, Bun, and browsers) so the browser-safe client build
 * can import it without pulling in `ws` or `node:*`.
 */
/** Subprotocol value prefix that marks the bearer token. */
export declare const BEARER_SUBPROTOCOL_PREFIX = "skaile-bearer.";
/**
 * Encode `token` as a subprotocol value. base64url keeps the result inside the
 * RFC6455 subprotocol `token` grammar regardless of the token's own characters.
 * Assumes an ASCII token (deploy-issued secrets are); non-Latin1 input throws in
 * `btoa`, which is the caller's signal to use an ASCII-safe token.
 */
export declare function encodeBearerSubprotocol(token: string): string;
/**
 * Pull the bearer token out of a (comma-separated) `Sec-WebSocket-Protocol`
 * header value. Returns `null` when no bearer subprotocol is present or it fails
 * to decode.
 */
export declare function decodeBearerFromHeader(header: string | undefined): string | null;
/**
 * Constant-time-ish string compare. Length is allowed to leak (cheap and
 * low-signal); the byte comparison itself does not short-circuit on the first
 * mismatch.
 */
export declare function tokensEqual(a: string, b: string): boolean;
//# sourceMappingURL=auth.d.ts.map