/**
 * Caller context — who is invoking scai *right now*.
 *
 * Phase 2 gates operations on this rather than on stored token
 * provenance: a token is acquired once and reused for weeks, so its
 * birth ("a human logged in") says nothing about the current caller
 * ("an unattended cron is replaying it"). Caller context is computed
 * fresh, per invocation, from the process environment.
 *
 * See docs/policy-and-guardrails.md (Phase 2).
 */
/** Who is invoking scai. */
export type CallerKind = "interactive-human" | "ci" | "m2m" | "mcp";
export interface CallerContext {
    kind: CallerKind;
    /** CI pipeline identifier, when one can be resolved from the environment. */
    pipelineId?: string;
}
/**
 * Resolve the current caller context. First match wins, in order:
 * `mcp` → `ci` → `interactive-human` → `m2m`.
 */
export declare const resolveCallerContext: () => CallerContext;