import type { AccessGrant } from "@opengeni/contracts";
import { type ApiRouteDeps } from "@opengeni/core";
type AssociatedInteractionSession = {
    associations: ReadonlyArray<{
        sessionId: string;
    }>;
};
/**
 * Narrow a workspace-wide BrowserSession/ComputerSession inventory to the
 * entries a live agent attempt may reach. Every attach-by-id route already
 * authorizes the exact source session through the core seam; the list is the
 * discovery surface behind `interaction_discover scope=workspace`, so it must
 * apply the same seam (private sessions, Slack ownership, and the 0426
 * agent-access scope) to each associated session instead of exposing every
 * peer's identity. Humans, API keys, and service principals keep the complete
 * workspace inventory exactly as before.
 */
export declare function filterInteractionSessionsForGrant<T extends AssociatedInteractionSession>(deps: Pick<ApiRouteDeps, "db" | "sessionAuthorization">, grant: AccessGrant, sessions: readonly T[]): Promise<T[]>;
export {};