/**
 * Authentication middleware for REST and Socket.IO.
 *
 * Enforcement is opt-in: when no password has been configured the server stays
 * fully open (preserving the original local-only experience). Once a password
 * is set, every request — except the public auth endpoints used to obtain a
 * token — must present a valid session token.
 *
 * Token sources accepted (in order):
 *   1. Authorization: Bearer <token>   (REST, used by web fetch/axios + mobile)
 *   2. x-auth-token: <token>           (REST convenience header)
 *   3. ?token=<token>                  (SSE / EventSource where headers can't be set)
 */
import { Request, Response, NextFunction } from 'express';
import { Socket } from 'socket.io';
export declare function requireAuth(req: Request, res: Response, next: NextFunction): void;
export declare function authorizeSocket(socket: Socket, next: (err?: Error) => void): void;