/**
 * Signed memory binding for a voice call.
 *
 * A voice worker persists a call's turns to a conversation, so it has to know
 * WHOSE conversation and WHICH one — and it must not take either from anything
 * a participant can influence. The manager that creates the room (for example
 * a `/start` endpoint) already holds the verified session, so it signs a small
 * binding and writes it into the room metadata next to `authToken` and
 * `mcpContext`:
 *
 *   base64(JSON({ authToken, mcpContext, memory: { userId, sessionId, exp, sig } }))
 *
 * The worker verifies the signature with the same shared secret. The signature
 * covers the room name, so a binding copied into another room does not verify.
 * Room metadata is readable by participants, so this does not hide the ids; it
 * stops anyone without the secret from choosing them.
 *
 * Everything here fails closed. A missing secret, a missing or malformed
 * binding, a bad signature or an expired binding all yield `{ ok: false }`, and
 * the caller carries on with the call, storing nothing.
 *
 * See docs/features/livekit-voice-agent.md.
 */
import type { VoiceMemoryBinding, VoiceMemoryBindingInput, VoiceMemoryBindingVerdict, VoiceMemoryBindingVerifyInput } from "../../types/index.js";
/** Domain-separation label that starts every signed message. */
export declare const VOICE_MEMORY_BINDING_VERSION = "neurolink.voice.memory.v1";
/** Environment variable the worker reads the shared secret from when none is passed in. */
export declare const VOICE_MEMORY_SECRET_ENV = "NEUROLINK_VOICE_MEMORY_SECRET";
/** Longest expiry, counted from now, that a worker accepts (24 hours). */
export declare const VOICE_MEMORY_MAX_TTL_SECONDS: number;
/** A conversation id a voice call may append to: letters, digits, "_" and "-", up to 128, no ":". */
export declare function isValidVoiceSessionId(value: unknown): value is string;
/** A user id a voice call may be bound to: 1 to 256 characters, no whitespace or control characters. */
export declare function isValidVoiceUserId(value: unknown): value is string;
/**
 * Sign a binding for a room. Throws on an unusable secret or invalid ids: the
 * signer is the trusted side, and a binding it cannot sign correctly is a bug
 * to surface there, not something to paper over.
 */
export declare function signVoiceMemoryBinding(input: VoiceMemoryBindingInput): VoiceMemoryBinding;
/**
 * Read and verify the memory binding in a room's metadata.
 *
 * Never throws and never logs ids. `reason` says why a binding was rejected so
 * the caller can log it.
 */
export declare function verifyVoiceMemoryBinding(input: VoiceMemoryBindingVerifyInput): VoiceMemoryBindingVerdict;