/**
 * The deploy approval token — a capability the engine hands the approver and
 * re-checks before it mutates. Wire format mirrors the MCP planToken:
 * `${planId}.${expMs}.${hmacHex}`.
 *
 * The token's `planId` IS the {@link digestHead} of the assembly digest, so the
 * binding to a specific synthesised plan is intrinsic and SECRET-FREE: the
 * verifier recomputes the digest from a fresh synth and the planId must match.
 * This is the load-bearing, cross-process no-TOCTOU guarantee (CLI plan→apply
 * and MCP plan→apply are separate processes). The HMAC is secondary
 * tamper-evidence — meaningful only when a STABLE secret is configured via
 * `FJALL_APPROVAL_TOKEN_SECRET` (set on the webapp worker / MCP host); with the
 * per-process random fallback it cannot be reproduced cross-process, so
 * verification falls back to the digest match alone.
 */
export declare const DEFAULT_APPROVAL_TTL_MS: number;
/**
 * TTL for the token re-minted when the destruction gate withholds an
 * approval-gated deploy. The consent ceremony can legitimately take far
 * longer than {@link DEFAULT_APPROVAL_TTL_MS} — the webapp lets a
 * `destructive_pending` row await a human for 24 hours
 * (`sweepAbandonedDestructivePendingSystem`) before abandoning it, and the
 * original 15-minute token would expire long before that, making the
 * ceremony unreachable for approval-gated deploys. 24h + 1h margin covers a
 * consent granted at the very end of the abandon window plus claim/queue
 * latency. Digest binding is unchanged: the re-minted token still refuses as
 * `superseded` the moment the plan moves, so only the TIME bound is relaxed —
 * and the withheld run already verified the original approval against this
 * same digest.
 */
export declare const DESTRUCTION_RESUME_TTL_MS: number;
export declare const APPROVAL_TOKEN_PATTERN: RegExp;
export interface SignApprovalTokenOptions {
    readonly assemblyDigest: string;
    readonly ttlMs?: number;
    readonly now?: () => number;
}
export interface SignedApprovalToken {
    readonly token: string;
    readonly expiresAt: string;
}
export declare function signApprovalToken(opts: SignApprovalTokenOptions): SignedApprovalToken;
export type VerifyApprovalTokenResult = {
    readonly ok: true;
} | {
    readonly ok: false;
    readonly reason: "malformed" | "superseded" | "expired" | "tampered";
};
export interface VerifyApprovalTokenOptions {
    readonly token: string;
    /** The freshly recomputed assembly digest the apply will execute against. */
    readonly assemblyDigest: string;
    readonly now?: () => number;
}
export declare function verifyApprovalToken(opts: VerifyApprovalTokenOptions): VerifyApprovalTokenResult;