/**
 * Session-token utilities. The token is a high-entropy secret; possession
 * grants read/write on the session. We don't HMAC frames — frames carry
 * the token directly (which is fine for in-process / same-origin / TLS
 * transports). For lower-trust transports, host apps can layer signing
 * on top of the BroadcastChannelTransport.
 */
type SessionDescriptor = {
    /** Stable session identifier. Channel name = `fai:share:${id}`. */
    id: string;
    /** Secret token. Treat as a password — anyone with it can read/write. */
    token: string;
    /** Pretty hash for display (first 8 chars of token). */
    display: string;
};
declare function createSessionDescriptor(): SessionDescriptor;
declare function describeSession(id: string, token: string): SessionDescriptor;
/**
 * Build the shareable URL for the current page (preserves path, adds
 * session+token in the URL FRAGMENT).
 *
 * The token goes in the `#fragment`, never the `?query`: a fragment is never
 * transmitted to the server, so it can't leak through access/proxy logs or the
 * `Referer` header sent to third-party assets on the page. The recipient reads
 * it back with {@link readSessionFromUrl}. (The on-wire relay leg still sends
 * `?token=` today — moving that off the query is the larger transport change.)
 */
declare function buildShareUrl(descriptor: SessionDescriptor, baseUrl?: string): string;
/** Build the JSON config form (suitable for Claude Desktop / Cline / etc.). */
declare function buildShareConfig(descriptor: SessionDescriptor, transport?: string): {
    name: string;
    transport: string;
    session: string;
    token: string;
    channel: string;
    protocol_version: string;
};
/**
 * Read session descriptor from the current URL, or null if not a shared link.
 * Prefers the fragment (the non-leaking form {@link buildShareUrl} now emits),
 * falling back to the query string for links minted before that change.
 */
declare function readSessionFromUrl(): SessionDescriptor | null;
/** Constant-time string compare so a mismatched token leaks no timing info. */
declare function constantTimeEqual(a: string, b: string): boolean;

export { type SessionDescriptor as S, buildShareUrl as a, buildShareConfig as b, createSessionDescriptor as c, describeSession as d, constantTimeEqual as e, readSessionFromUrl as r };