/**
 * In-app browser -> real browser handoff.
 *
 * An ad tapped inside Instagram / Facebook / TikTok opens in the app's own webview,
 * whose cookie jar is separate from Safari/Chrome. When the person then taps the app's
 * "Open in Safari/Chrome", the real browser opens whatever URL is in the address bar and
 * starts as a brand-new visitor, so the ad click and the purchase never meet (88.5% of
 * click-bearing visitors arrive in an in-app browser, measured 2026-09-18).
 *
 * So while we run INSIDE an in-app browser we keep a short-lived token in the address
 * bar (`?_dl_h=<visitor>.<time>`), refreshed while the page is open. Whenever the person
 * opens the page in their real browser, the URL already carries it and that browser
 * continues as the same visitor. No banner, no prompt, nothing visible on the page.
 *
 * This is NOT the old raw `_dl_vid` (removed in FSR-50 because a shared link merged
 * unrelated people). What makes it safe:
 *   - it expires: both browsers are on the same device and clock, so a token older than
 *     IN_APP_HANDOFF_MAX_AGE_MS (2 minutes) is refused. A link pasted into a chat later does
 *     nothing;
 *   - a webview never forwards a token it did not write: an inbound `_dl_h` is stripped there
 *     whether or not the writer is allowed to run, so a stranger's token cannot ride along;
 *   - it is only adopted by a browser that has NO visitor yet (an existing identity
 *     always wins) and that is itself a real browser, not another webview;
 *   - the id must be one we minted (anon_<uuid>); anything else is ignored;
 *   - it is emitted only inside an in-app browser and only while tracking is allowed;
 *   - it is stripped from the address bar on arrival and never reaches a tracked URL.
 */
export declare const IN_APP_HANDOFF_PARAM = "_dl_h";
export declare const IN_APP_HANDOFF_MAX_AGE_MS: number;
export declare const IN_APP_HANDOFF_REFRESH_MS: number;
/** True inside an app whose in-app browser can hand the page to the real browser. */
export declare function isHandoffSourceApp(userAgent?: string): boolean;
/** True inside ANY webview (broad on purpose: a webview must never adopt or forward a token). */
export declare function isInAppBrowser(userAgent?: string): boolean;
/** `<visitor>.<base36 ms>`, or null when the id is not one we minted. */
export declare function encodeInAppHandoff(visitorId: string | null | undefined, now: number): string | null;
/** The visitor id when the token is one of ours and still fresh, else null. */
export declare function parseInAppHandoff(raw: unknown, now: number): string | null;
//# sourceMappingURL=in-app-handoff.d.ts.map