/**
 * Data-link secret resolution — copied from mcp-ui `src/utils/dataLinkSecret.ts`.
 *
 * The secret comes from the environment, never from source. Production-like
 * environments fail closed when it is missing, a known dev default, or too
 * short. A local install with no secret mints a random one and keeps it next
 * to the data-link store, so the published package never signs with a constant
 * an attacker can read out of npm.
 */
/** Known unsafe defaults that must never ship in production (FUS-3988 / MVP-P04). */
export declare const DEV_DATA_LINK_SECRETS: Set<string>;
export declare const DATA_LINK_SECRET_ENV = "MCP_DATA_LINK_SECRET";
export type SecretOk = {
    ok: true;
    secret: string;
};
export type SecretFail = {
    ok: false;
    reason: string;
};
export declare function isProductionLikeEnv(env?: NodeJS.ProcessEnv): boolean;
export declare function resolveDataLinkSecret(env?: NodeJS.ProcessEnv): string;
export declare function isUnsafeDataLinkSecret(secret: string): boolean;
/**
 * Fail closed in production-like envs when the secret is missing or a known
 * default. Local/dev mints a per-install secret when the env value is missing
 * or unsafe.
 */
export declare function assertSafeDataLinkSecret(env?: NodeJS.ProcessEnv): SecretOk | SecretFail;
/** Throwing wrapper for the signing path — never sign with an unsafe secret. */
export declare function requireDataLinkSecret(env?: NodeJS.ProcessEnv): string;