/**
 * Realtime subscribe-token mint endpoint.
 *
 * `GET /_agent-native/realtime-token` — the one Netlify request per page load
 * that the hosted Realtime Gateway path needs. The SSR HTML/`.data` shell is a
 * single impersonal, CDN-cached document (`guard:ssr-cache-shell`), so a
 * per-visitor token cannot be baked into the page; the client mints it here
 * after load. Same-origin + session-gated; sessionless requests get 401.
 *
 * The signed token binds this app's Builder project id (the gateway channel)
 * and carries the app's own end-user identity (`owner` = session email, `orgId`
 * = framework org) — the exact tuple `recordChange` stamps onto `sync_events`
 * and the gateway feeds to `canSeeChangeForUser`. It is signed with the app's
 * per-project HMAC secret, injected as a reserved env var at provision time.
 */
/**
 * Reserved env var holding the app's per-project HMAC secret. Injected by the
 * Builder provisioning path (`SYSTEM_RESERVED_KEYS` + prod allowlist); see the
 * Agent-Native Realtime Sync tech spec.
 */
export declare const REALTIME_HMAC_SECRET_ENV = "AGENT_NATIVE_REALTIME_HMAC_SECRET";
export declare function getRealtimeSigningSecret(): string | undefined;
export declare function createRealtimeTokenHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
    error: string;
    token?: undefined;
    expiresAt?: undefined;
    ttlSeconds?: undefined;
} | {
    token: string;
    expiresAt: string;
    ttlSeconds: number;
    error?: undefined;
}>>;
//# sourceMappingURL=realtime-token.d.ts.map