/**
 * platform-identity.ts
 *
 * Resolves workspace and user identity for Platform API calls made from the
 * CLI and SDK.
 *
 * Identity sources (evaluated in priority order):
 *
 *   AI_GUARD_WORKSPACE_ID   — explicit workspace UUID (required in team/ent plans)
 *   AI_GUARD_API_KEY        — bearer token for the Platform API
 *   GitHub auth store       — login used as fallback actor identity
 *
 * Event IDs for usage recording are derived deterministically from (workspaceId
 * + action + current minute bucket) so that CLI retries within the same minute
 * are idempotent without requiring the caller to supply an external UUID.
 */
export type PlatformIdentity = {
    /** Workspace UUID or "default" when not configured */
    workspaceId: string;
    /** Bearer token to send in Authorization header. undefined = unauthenticated */
    apiKey: string | undefined;
    /** Human-readable actor string, e.g. "github:octocat" or "local:default" */
    actorId: string;
    /** User ID for bypass-token auth flows. Set via AI_GUARD_USER_ID env var. */
    userId: string;
    /** Role for bypass-token auth flows. Set via AI_GUARD_USER_ROLE env var. */
    userRole: string;
};
export declare function resolvePlatformIdentity(): Promise<PlatformIdentity>;
/**
 * Derive a stable event ID for idempotent usage recording.
 *
 * Key: workspaceId + actorId + action + minute-granularity UTC timestamp.
 * Two calls within the same minute round for the same action produce the same
 * event ID, so retries are naturally deduplicated by the server.
 *
 * If you need to record multiple events in the same minute (e.g. a batch scan)
 * pass a unique `suffix` (e.g. loop index or target path hash).
 */
export declare function deriveEventId(workspaceId: string, actorId: string, action: string, suffix?: string): string;
/**
 * Generate a truly random event ID. Use this when you explicitly want no
 * deduplication (e.g. recording multiple distinct scan events in one session).
 */
export declare function randomEventId(): string;
/** Generate a new API key. Returns both the plaintext (show once) and SHA-256 hash (store). */
export declare function generateApiKey(): {
    plaintext: string;
    hash: string;
};
/** Hash an API key with SHA-256 for storage. Uses timing-safe comparison for validation. */
export declare function hashApiKey(apiKey: string): string;
/** Constant-time comparison of two hex hash strings. */
export declare function timingSafeEqualHex(a: string, b: string): boolean;
/** Check if a token looks like an AI Guard API key (for routing in auth). */
export declare function isApiKeyFormat(token: string): boolean;