/**
 * Guest access token service.
 *
 * Generates and validates per-submission access tokens for guest agents
 * that don't have AAuth keys. Tokens are UUIDs stored alongside the
 * entities they grant access to, enabling submitter read-back without
 * requiring cryptographic identity.
 *
 * Storage: tokens are persisted as `guest_access_token` entities in the
 * operator's store, linked to the entities they cover via REFERS_TO.
 */
export interface GuestAccessToken {
    token: string;
    entity_ids: string[];
    thumbprint?: string;
    created_at: string;
    ttl_seconds: number;
    revoked_at?: string | null;
}
export declare function hashGuestAccessToken(token: string): string;
/**
 * Generate a new guest access token and persist it.
 * Called after a successful guest write to return a read-back credential.
 */
export declare function generateGuestAccessToken(params: {
    entityIds: string[];
    userId: string;
    thumbprint?: string;
}): Promise<string>;
/**
 * Validate a guest access token and return the entity IDs it covers.
 * Returns null if the token is invalid or not found.
 */
export declare function validateGuestAccessToken(token: string): Promise<GuestAccessToken | null>;
/**
 * Check whether a guest access token grants access to a specific entity.
 */
export declare function tokenGrantsAccessTo(token: string, entityId: string): Promise<boolean>;
//# sourceMappingURL=guest_access_token.d.ts.map