import type { ConversationStateSnapshot, GenericMessage } from '../../shared/types.js';
/**
 * HMAC-based verification: agent auth tokens (WebSocket handshake) and
 * conversation-state tamper detection. Both fail closed on a missing secret.
 */
/** Seconds an agent auth token remains valid after issuance. */
export declare const TOKEN_EXPIRY_SECONDS = 300;
/**
 * Validate an HMAC auth token: well-formed `<timestamp>:<hmac>`, not expired,
 * and HMAC matches. Does NOT track one-time use — `SessionManager` layers its
 * replay check on top. Returns false (never throws) on any malformed input.
 */
export declare function validateToken(token: string, secret: string): boolean;
/**
 * Compute an HMAC-SHA256 hash for a conversation state snapshot.
 */
export declare function computeStateHash(messages: GenericMessage[], activatedLazyTools: string[], secret: string): string;
/**
 * Verify the HMAC hash of a conversation state snapshot.
 * Uses timing-safe comparison to prevent timing attacks.
 */
export declare function verifyStateHash(snapshot: ConversationStateSnapshot, secret: string): boolean;