export interface SandboxScope {
    projectId: string;
    goalIds: Set<string>;
    sessionIds: Set<string>;
}
/**
 * In-memory store mapping sandbox tokens to their scoped project information.
 *
 * Each sandboxed project gets a unique 256-bit random token that restricts
 * API access to only the endpoints that project's sessions need. Tokens are NOT
 * persisted — they are regenerated on server restart during session restore.
 *
 * SECURITY: Tokens are stored in-memory ONLY (Map). They are never persisted
 * to disk — not in sessions.json, not in any state file. This is by design:
 * tokens are regenerated on server restart during session restore. If a
 * container is compromised, the token cannot be extracted from disk.
 */
export declare class SandboxTokenStore {
    private tokens;
    private projectToToken;
    /** Generate or return the sandbox token for a project. Idempotent. */
    register(projectId: string): string;
    /** Look up scope for a token. Returns undefined if not a sandbox token. */
    lookup(token: string): SandboxScope | undefined;
    /** Track a session under the project's scope. */
    addSession(projectId: string, sessionId: string): void;
    /** Track a goal under the project's scope. */
    addGoal(projectId: string, goalId: string): void;
    /** Remove a session from the project's scope. */
    removeSession(projectId: string, sessionId: string): void;
    /** Remove a goal from the project's scope. */
    removeGoal(projectId: string, goalId: string): void;
    /** Remove an entire project scope and its token. */
    remove(projectId: string): void;
    /** Reverse lookup: get the scoped token for a project ID. */
    getTokenForProject(projectId: string): string | undefined;
}
//# sourceMappingURL=sandbox-token.d.ts.map