import { type ParsedArgs } from "@cotal-ai/core";
export declare const whoamiFlags: readonly [{
    readonly name: "space";
    readonly short: "s";
    readonly type: "string";
    readonly value: "<s>";
    readonly description: "target space (default: the resolved mesh)";
}, {
    readonly name: "server";
    readonly type: "string";
    readonly value: "<url>";
    readonly description: "broker URL (overrides the mesh registry entry)";
}, {
    readonly name: "json";
    readonly short: "j";
    readonly type: "boolean";
    readonly description: "structured output on stdout";
}, {
    readonly name: "plain";
    readonly type: "boolean";
    readonly description: "plain line-oriented output";
}];
/** Every channel, or every capability: what an identity holds when nothing narrows it. */
type Grant = readonly string[] | "all";
/** What `cotal whoami` reports for the selected space: the identity this CLI acts under and what it
 *  may read, post and do. `null` is a grant this machine cannot read; the warnings say why. */
export interface WhoamiResult {
    readonly kind: "identity";
    readonly space: string;
    readonly server: string;
    readonly mode: "open" | "auth" | "user";
    readonly identity: {
        /** `open`: the broker authenticates nothing. `space-signer`: this machine holds the space's
         *  signing key and each command mints its own short-lived credential. `no-credential`: it holds
         *  none. `user`: the signed-in user's `cli` actor. */
        readonly kind: "open" | "space-signer" | "no-credential" | "user";
        readonly principal: string | null;
        readonly owner: string | null;
        readonly actor: string | null;
        readonly subject: string | null;
        readonly loginExpiresAt: string | null;
        /** A signed-in user's ledger row: `granted`, `not-granted`, or `not-local` when the ledger is
         *  not on this machine. `null` for every other kind of identity, and before sign-in. */
        readonly grant: "granted" | "not-granted" | "not-local" | null;
    };
    readonly read: Grant | null;
    readonly post: Grant | null;
    readonly dms: boolean | null;
    readonly capabilities: Grant | null;
}
/** `cotal whoami`: what this CLI's one-shot identity holds in the selected space. It reads the
 *  registry, the login cache and, where it is on this machine, the grant ledger; it connects to
 *  nothing, since a one-shot process has no session to report. */
export declare function whoami(args: ParsedArgs): Promise<void>;
export {};
//# sourceMappingURL=whoami.d.ts.map