export interface RequestIdentity {
    /** The bearer the caller presented. Never read from disk, never cached. */
    apiKey: string;
    /** For log correlation. Not sent upstream. */
    requestId?: string;
    /**
     * The calling platform (lovable, bolt, replit, base44, …), from Origin.
     * Sent upstream as x-mcp-client so retention can be split per platform —
     * detectIde() cannot do this in a container, where there is no editor env.
     */
    platform?: string;
    /**
     * The caller's literal Origin header, or "". Sent upstream as x-mcp-origin
     * so an unrecognised platform can still be COUNTED. We stopped blocking
     * unknown origins (see http.ts); measuring them is what replaces the block.
     */
    rawOrigin?: string;
}
/** Run `fn` with this request's identity bound to the async context. */
export declare function withRequestIdentity<T>(id: RequestIdentity, fn: () => Promise<T>): Promise<T>;
/**
 * The identity of the in-flight request, or undefined outside one.
 *
 * `undefined` is the normal case for stdio and CI — it is how those keep their
 * existing behaviour rather than a failure.
 */
export declare function currentIdentity(): RequestIdentity | undefined;
/**
 * True inside an HTTP request, or when the deployment declares hosted mode.
 *
 * Gates the device flow. `withSignIn` calls writeCredentials on success, and
 * on a shared server that write IS the leak — one user's browser sign-in
 * would become every user's credential. A hosted caller presents a key the
 * platform already holds; it never completes a browser flow on our box.
 * Request scope is authoritative even when a local HTTP launch omits the
 * deployment flag. Stdio and CI do not enter this scope.
 */
export declare function isHosted(): boolean;