/**
 * The coarse three-way type provenance has always used. Kept as a separate
 * axis from IdentityKind on purpose: `agent:` is a roster AGENT for the
 * purposes of resolution, and an AI actor for the purposes of provenance.
 * Both are true, and collapsing them would lose one.
 */
export type ActorType = 'human' | 'ai' | 'system';
/** What kind of thing an id names. Mirrors hq.resolve_ids' `kind` column. */
export type IdentityKind = 'user' | 'agent' | 'team' | 'org' | 'guest' | 'human' | 'ai' | 'system';
export interface ParsedIdentity {
    /** The id exactly as written. This is what goes in the record. */
    raw: string;
    /** Lowercased prefix, without the colon. */
    prefix: string;
    /** Everything after the first colon, unmodified. */
    value: string;
    kind: IdentityKind;
    /**
     * True when the roster can resolve this id to a display name — that is,
     * user:, agent: and team:. False for human:, ai:, system: and friends, which
     * render as themselves and are honest about it.
     */
    resolvable: boolean;
}
/**
 * Split a prefixed id. Returns null for anything without a recognised prefix.
 *
 * Deliberately lenient about the VALUE: `human:mediareason <brottler@gmail.com>`
 * is a real id in this repo's history — a git ident string, spaces, angle
 * brackets, an embedded email and all. Nothing here may split, slugify or
 * normalise it, because doing so would silently rewrite 202 existing events.
 */
export declare function parseIdentity(raw: string | undefined | null): ParsedIdentity | null;
/**
 * The coarse actor type for an id. This is the canonical implementation —
 * provenance's own classification defers to it so the two cannot drift.
 *
 * Unknown prefixes fall through to 'human', preserving the behaviour
 * provenance has always had. That fall-through is safe ONLY because a `team:`
 * id is rejected before it can reach an actor position; see assertActor.
 */
export declare function actorTypeOf(raw: string): ActorType;
export declare class IdentityError extends Error {
}
/**
 * Assert that `raw` may stand where an actor or an assignee is expected.
 *
 * A `team:` id is specifically rejected here. Assigning to a team is what the
 * `team` FIELD expresses; keeping assignee singular is what keeps a team a
 * lens rather than an owner, which is Ben's decision in ADR-0011. Without this
 * check, `team:<uuid>` would classify as 'human' through the fall-through in
 * actorTypeOf and be recorded as a person.
 */
export declare function assertActor(raw: string): ParsedIdentity;
/** Assert that `raw` may stand in a `team` field. Only `team:` ids qualify. */
export declare function assertTeam(raw: string): ParsedIdentity;
export interface ActingIdentity {
    /** The prefixed id to stamp on records. */
    id: string;
    parsed: ParsedIdentity;
    /** Where it came from, for diagnosis when it is not what someone expected. */
    source: 'header' | 'env' | 'git' | 'os';
    /**
     * Whether the identity was PROVEN, as opposed to merely asserted.
     *
     * It is false for every source today, including the JWT one, and that is not
     * an oversight. The `sub` claim is read out of X-User-Key WITHOUT verifying
     * the token's signature, because verifying costs a network round trip on
     * every dispatch. Under ADR-0011 a team is a lens and not a wall, so
     * attribution is not a privilege boundary and an unverified author is a
     * wrong label rather than an escalation.
     *
     * That reasoning expires the moment teams become a wall. This flag exists so
     * the assumption is visible in the data instead of being rediscovered later
     * from a codebase that looks like it verifies and does not.
     */
    verified: boolean;
}
/** Injected so tests can drive the local-identity path without touching env. */
export interface LocalIdentitySources {
    env?: NodeJS.ProcessEnv;
    gitUser?: () => string | null;
}
/**
 * The git identity as `name <email>`, or the bare name, or null.
 *
 * This is the canonical implementation; provenance defers to it so the two
 * cannot drift. It is also why the ids on disk look the way they do — the
 * angle-bracket form is a git ident string, not a handle, and parseIdentity
 * preserves it verbatim for that reason.
 */
export declare function gitUserIdent(): string | null;
/** Test seam: drop the memoised git identity. */
export declare function resetGitUserCache(): void;
/**
 * The acting identity for this call.
 *
 * Order: an explicit DECIBEL_ACTOR_ID always wins, because it is the only way
 * an operator can state who they are; then the JWT; then git; then the OS
 * user. The env var outranks the header deliberately — a machine configured to
 * say who it is should not be overridden by whatever token a caller presents.
 */
export declare function resolveActingIdentity(ctx: {
    userKey?: string;
} | undefined, sources?: LocalIdentitySources): ActingIdentity;
/**
 * Run `fn` with `identity` as the acting identity. Nested calls keep the
 * outermost identity: a tool that dispatches another tool is still the same
 * person acting, and re-deriving it inside would let a delegated call
 * attribute itself to the daemon's local user.
 */
export declare function withIdentity<T>(identity: ActingIdentity, fn: () => Promise<T>): Promise<T>;
/**
 * The acting identity for the current dispatch, if a scope is open.
 *
 * Returns undefined outside a scope rather than inventing an identity. A
 * writer that gets undefined should omit the field, not guess — an absent
 * author is honest, and a wrong one is not.
 */
export declare function currentIdentity(): ActingIdentity | undefined;
/** The id to stamp, or undefined outside a dispatch scope. */
export declare function currentActorId(): string | undefined;
//# sourceMappingURL=identity.d.ts.map