/** The USER_ID stamped on an rc-spawn child PTY. Authenticated admin identity
 *  wins; then the server-resolved per-session override; then empty. Empty is a
 *  documented-legal USER_ID — the owner is never substituted here. */
export declare function resolveSpawnUserId(input: {
    resolvedAdminUserId?: string | null;
    overrideUserId?: string;
}): string;
/**
 * Reconcile the two INDEPENDENT identity signals a spawn request carries and
 * report the USER_ID actually stamped. `authenticatedAdmin` is `adminUserId`,
 * resolved by the UI from the validated PIN session; `resolvedOverride` is
 * `overrideUserId`, resolved by the UI from users.json/account.json. They name
 * the same admin, so a disagreement is a genuine identity fault — `match=false`
 * is the standing alarm. A spawn-time comparison of the stamped USER_ID against
 * `authenticatedAdmin` would be tautological (the stamp is derived from it), so
 * the reconciliation is between the two independently-derived inputs. When only
 * one signal is present there is nothing to reconcile and `match` is true;
 * `stamped` still records what went to USER_ID for the forensic trail.
 */
export declare function formatMcpUserBindingLine(input: {
    authenticatedAdmin: string | null;
    resolvedOverride?: string;
    stampedUserId: string;
}): string;
//# sourceMappingURL=mcp-user-binding.d.ts.map