export declare const WINDOW_LABEL_HEADER = "x-murasaki-window-label";
export declare const WINDOW_GENERATION_HEADER = "x-murasaki-window-generation";
export declare const WINDOW_TOKEN_HEADER = "x-murasaki-window-token";
export declare const WINDOW_LABEL_QUERY = "__murasaki_window";
export declare const WINDOW_GENERATION_QUERY = "__murasaki_window_generation";
export declare const WINDOW_TOKEN_QUERY = "__murasaki_window_token";
type RuntimeRequest = {
    url?: string;
    headers: Record<string, string | string[] | undefined>;
};
/** Derive an unforgeable renderer identity without persisting another secret. */
export declare function deriveWindowToken(runtimeToken: string, label: string, generation?: number): string;
/**
 * Authenticate a renderer request and return its native-assigned window label.
 * Query credentials are accepted only by callers that explicitly opt in (SSE
 * cannot set request headers); normal fetch/XHR requests must use headers.
 */
export declare function authenticateWindowRequest(req: RuntimeRequest, runtimeToken: string, allowQuery?: boolean): string | null;
/** Exact grants and a single trailing `*` prefix wildcard. */
export declare function isBackendCapabilityAllowed(grants: readonly string[], resource: string): boolean;
/**
 * Trusted document-start script. The token identifies this window; it is not
 * an app-wide bearer secret. A compromised renderer can act only with its own
 * allowlist and cannot mint another window label.
 */
export declare function createWindowAuthInitScript(runtimeToken: string, label: string, expectedOrigin: string): string;
export {};
//# sourceMappingURL=window-auth.d.ts.map