/**
 * RdpAuth — handles the security negotiation layer for RDP connections.
 *
 * Supported protocols (negotiated via X.224 Negotiation Request):
 *   PROTOCOL_RDP    (0) — Classic RDP Security (RC4); rarely used today
 *   PROTOCOL_SSL    (1) — TLS wrapping (most XRDP servers)
 *   PROTOCOL_HYBRID (2) — CredSSP / NLA (Windows default; Phase 2)
 *
 * For Phase 1 (XRDP / local targets) we negotiate TLS-only (PROTOCOL_SSL).
 * This avoids the full CredSSP/NTLM stack and works against:
 *   - xrdp with TLS enabled  (default on modern Linux)
 *   - Windows 2008+ with "Allow connections from … any version" security level
 *
 * NLA (CredSSP) is prepared as a future phase — see negotiateNla().
 */
import * as net from 'net';
import * as tls from 'tls';
/**
 * Build an X.224 Connection Request TPDU with an RDP Negotiation Request
 * appended as a type-length-value (TLV) trailer.
 *
 * The cookie (mstshash=<username>) is optional but recommended for xrdp
 * load-balancing.
 */
export declare function buildX224ConnectRequest(requestedProtocols: number, username?: string): Buffer;
/**
 * Parse the X.224 Connection Confirm TPDU (and optional Negotiation Response).
 * Returns the selected protocol or throws on failure.
 */
export declare function parseX224ConnectConfirm(data: Buffer): number;
/**
 * Upgrade a plain TCP socket to TLS.
 * Returns the TLS socket once the handshake is complete.
 * Certificate validation is disabled (self-signed is the norm for RDP).
 */
export declare function upgradeTls(sock: net.Socket, host: string): Promise<tls.TLSSocket>;
/**
 * Generate a 32-byte random client random for Classic RDP Security.
 * Not used in TLS mode but exposed for completeness / future use.
 */
export declare function generateClientRandom(): Buffer;
/**
 * Placeholder for CredSSP / NLA negotiation.
 * Full NTLM + CredSSP is complex; this throws with a clear message so callers
 * can detect that NLA is required and surface a useful error to the user.
 *
 * @throws Always — NLA is not yet implemented.
 */
export declare function negotiateNla(_sock: tls.TLSSocket, _username: string, _password: string, _domain: string): Promise<void>;
/**
 * Choose the best protocol to request during X.224 negotiation.
 * We always try TLS first; fall back to classic RDP only if the server
 * explicitly rejects and the caller retries.
 */
export declare function selectRequestProtocol(): number;