import type http from "node:http";
import { type CallerIdentityOptions } from "./session-comm-guards.js";
/**
 * Who may open a WebSocket upgrade.
 *
 * The HTTP side of caller identity is enforced by the request handler; an
 * upgrade never reaches it, so these are the equivalent gate for a socket. Both
 * answer on the raw socket, because there is no ServerResponse to write to once
 * the connection is being upgraded.
 */
/** The little of a raw upgrade socket a rejection needs. */
export type UpgradeRejectionSocket = {
    write(chunk: string): unknown;
    destroy(): unknown;
};
export declare function rejectUnverifiedIdentifiedUpgradeCaller(req: http.IncomingMessage, socket: UpgradeRejectionSocket, options?: Pick<CallerIdentityOptions, "sessionExists">): boolean;
export declare function rejectNonOperatorPtyUpgradeCaller(req: http.IncomingMessage, socket: UpgradeRejectionSocket, options?: Pick<CallerIdentityOptions, "sessionExists" | "operatorAuthenticated">): boolean;
//# sourceMappingURL=upgrade-guards.d.ts.map