/**
 * RFB authentication algorithms.
 *
 * Supported security types:
 *   1  — None (no auth required)
 *   2  — VNC Authentication (DES challenge-response)
 *  18  — TLS (opportunistic — we accept the server cert without validation;
 *              used as a wrapper; inner auth type negotiated separately)
 *  19  — VeNCrypt (TLS variants; we handle plain + VNC sub-types)
 *
 * RFB 3.3 only ever sends a single auth type as a 4-byte uint.
 * RFB 3.7 / 3.8 send a length-prefixed list; the client picks one.
 */
import * as tls from 'tls';
import * as net from 'net';
export declare const AUTH_NONE = 1;
export declare const AUTH_VNC = 2;
export declare const AUTH_TIGHT = 16;
export declare const AUTH_VENCRYPT = 19;
export declare const VENCRYPT_PLAIN = 256;
export declare const VENCRYPT_TLSNONE = 257;
export declare const VENCRYPT_TLSVNC = 258;
export declare const VENCRYPT_TLSPLAIN = 259;
export declare const VENCRYPT_X509NONE = 260;
export declare const VENCRYPT_X509VNC = 261;
export declare const VENCRYPT_X509PLAIN = 262;
/**
 * VNC challenge-response: DES-encrypt the 16-byte challenge with the
 * bit-reversed password key.
 */
export declare function vncDesResponse(challenge: Buffer, password: string): Buffer;
/**
 * Sorted list of auth types we can handle, in preference order.
 * The bridge uses this when negotiating RFB 3.7/3.8 security type lists.
 */
export declare const SUPPORTED_AUTH_TYPES: number[];
/**
 * Pick the best supported auth type from a server-provided list.
 * Returns undefined if none are supported.
 */
export declare function pickAuthType(serverTypes: number[]): number | undefined;
/**
 * Negotiate VeNCrypt on a raw socket.  On success, returns the upgraded stream
 * (plain socket or TLS socket) plus the chosen sub-type so the caller knows
 * which inner auth to perform next.
 *
 * Throws on failure.
 */
export declare function negotiateVeNCrypt(sock: net.Socket, readBytes: (n: number) => Promise<Buffer>, password: string | undefined, username: string | undefined): Promise<{
    stream: net.Socket | tls.TLSSocket;
    subType: number;
}>;