export type CandidatesFilter = "empty" | "single-assistant";
export interface FilterTokenPayload {
    filter: CandidatesFilter;
    agentType?: "admin" | "public";
    accountId: string;
    issuedAt: number;
    nonce: string;
}
export type VerifyOutcome = {
    ok: true;
    payload: FilterTokenPayload;
} | {
    ok: false;
    reason: "malformed" | "bad-signature" | "expired";
};
/** Mint a signed filter token for the given selection context. */
export declare function mintFilterToken(input: {
    filter: CandidatesFilter;
    agentType?: "admin" | "public";
    accountId: string;
}): string;
/**
 * Verify a filter token. Returns the payload when signature+TTL pass; returns
 * a structured rejection reason otherwise. Callers must treat a rejection as
 * load-bearing — never silently fall back to "delete anyway."
 */
export declare function verifyFilterToken(token: string, opts?: {
    ttlMs?: number;
    now?: number;
}): VerifyOutcome;
/**
 * Short hash of the token for log correlation — never logs the raw token.
 * Use in `[memory-delete] filterToken=<sha8>` emissions.
 */
export declare function filterTokenFingerprint(token: string): string;
//# sourceMappingURL=filter-token.d.ts.map