export declare function readEmbedMcpChatBridgeFlagFromUrl(): boolean;
export declare function markEmbedMcpChatBridgeActive(): void;
export declare function isEmbedMcpChatBridgeActive(): boolean;
export declare function getEmbedAuthToken(): string | null;
/**
 * True when the embed credential is a directory-widget read capability, which
 * only the MCP App widget flows mint. It stays readable after a client
 * navigation drops the URL params, so it identifies a widget document without
 * the chat-bridge flag. The token's claims are only a UI hint (the signature
 * is checked server-side), so this decides what not to attempt, never what is
 * allowed.
 */
export declare function hasMcpDirectoryWidgetCapabilityToken(): boolean;
export declare function hasMcpDirectoryWidgetWriteCapabilityToken(): boolean;
/**
 * True when this document is the app nested in an MCP App widget shell (the
 * chat bridge is active) on a directory-widget read capability, which the
 * server limits to the widget's own resource reads.
 */
export declare function isMcpDirectoryWidgetReadOnlyEmbed(): boolean;
export declare function isMcpDirectoryWidgetWriteEmbed(): boolean;
export declare function isEmbedAuthActive(): boolean;
export declare function _resetEmbedAuthForTests(): void;
/**
 * Forgets every replayed refusal. Call it when access is known to have
 * changed, such as a link's status turning `allowed`: a refusal recorded
 * before then would otherwise fail the next read for up to a minute.
 */
export declare function forgetAuthFailures(): void;
export declare function ensureEmbedAuthFetchInterceptor(): void;