import { type IControllerMcpCaller, type IControllerRuntimeId, type TControllerMcpSubject } from '../dist_ts_interfaces/index.js';
export declare const anonymousControllerMcpCaller: IControllerMcpCaller;
/** Minted credentials, keyed by digest so the raw value is never retained. */
export declare class ControllerMcpCallerRegistry {
    private readonly callersByCredentialKey;
    mint(subjectArg: Exclude<TControllerMcpSubject, {
        kind: 'anonymous';
    }>): string;
    /** An unknown, malformed or revoked credential degrades to anonymous, never to an error. */
    resolve(credentialArg: string | undefined): IControllerMcpCaller;
    revokeCredential(credentialArg: string): void;
    revokeTerminal(projectIdArg: string, resourceIdArg: string): void;
    revokeSession(projectIdArg: string, sessionIdArg: IControllerRuntimeId): void;
    revokeRuntime(runtimeGenerationArg: string): void;
    clear(): void;
    get size(): number;
    private revokeWhere;
}
export declare const runWithControllerMcpCaller: <T>(callerArg: IControllerMcpCaller, operationArg: () => T) => T;
export declare const currentControllerMcpCaller: () => IControllerMcpCaller;