import type { ResolvedMcpConfig } from "../shared/types.js";
export declare const MCP_SESSION_ID_ARG = "--jinn-session-id";
export declare const MCP_HOME_ARG = "--jinn-home";
export declare const MCP_GATEWAY_URL_ARG = "--jinn-gateway-url";
/** Remove per-session bootstrap flags before writing a process-global MCP config. */
export declare function stripMcpBootstrapArgs(args?: readonly string[]): string[];
/**
 * GRS-017a — the caller-identity seam.
 *
 * The built-in `jinn` MCP server is spawned per session by the engine; for the
 * gateway to know WHICH session is calling (parent auto-linkage on spawn, the
 * no-self / rate-cap / hop-budget guards on lateral sends, own-descendant
 * scoping on stop), the session's id rides:
 *
 *   manager.route() ── JINN_SESSION_ID + JINN_SESSION_CAPABILITY env on the jinn server spec (this module)
 *     → MCP server ctx (server.ts reads the env)
 *     → `x-jinn-caller-session` + `x-jinn-session-capability` headers on every gateway call (toolkit.ts)
 *     → the session routes read the header (api.ts)
 *
 * The session id is descriptive; the capability is the server-minted proof that
 * this particular built-in MCP process was provisioned for that session. It is
 * defense-in-depth for local, single-user Jinn: it prevents a prompt-injected
 * tool caller from spoofing another session's id on scoped writes. It is not an
 * internet auth boundary; the operator/global-token path remains unchanged.
 *
 * BEST-EFFORT DOES NOT MEAN FAIL-OPEN (GRS-017 codex finding 2). The MCP tools
 * always run ON BEHALF OF a session, so a tool call whose identity/capability
 * got LOST (an engine stripping env from the server) must be REFUSED for scoped
 * session operations — never routed down the no-header operator path, which is
 * genuinely unrestricted. To tell the two apart, every tool request carries
 * {@link TOOL_CALL_HEADER}: marker + bound identity → scoped session call;
 * marker WITHOUT a valid bound identity → fail closed; no marker →
 * operator/UI/internal, unchanged. The gateway side of this rule lives in
 * `gateway/session-comm-guards.ts#resolveCallerIdentity`.
 */
/** Env var carrying the calling session's id into the jinn MCP server process. */
export declare const JINN_SESSION_ID_ENV = "JINN_SESSION_ID";
/** Env var carrying the per-session capability into that session's jinn MCP server. */
export declare const JINN_SESSION_CAPABILITY_ENV = "JINN_SESSION_CAPABILITY";
/** Non-authoritative visibility hint for attempt-only tools; routes still verify the caller session. */
export declare const JINN_WORKFLOW_ATTEMPT_ENV = "JINN_WORKFLOW_ATTEMPT";
/** Header carrying the calling session's id on gateway requests. */
export declare const CALLER_SESSION_HEADER = "x-jinn-caller-session";
/** Header carrying the per-session capability on gateway requests. */
export declare const CALLER_SESSION_CAPABILITY_HEADER = "x-jinn-session-capability";
/** Header marking a gateway request as originating from a jinn MCP TOOL call
 *  (sent unconditionally by the toolkit's gatewayRequest). Presence is the
 *  signal; the value is documentation. */
export declare const TOOL_CALL_HEADER = "x-jinn-tool-call";
export declare const TOOL_CALL_HEADER_VALUE = "jinn-mcp";
/** Per-tools/call correlation authored by the built-in Session-bound MCP server. */
export declare const ACTIVITY_OPERATION_HEADER = "x-jinn-activity-operation";
export declare const ACTIVITY_TOOL_HEADER = "x-jinn-activity-tool";
/** The shared refusal for a tool call that lost its identity — thrown by the
 *  tool handlers (local pre-check) and returned as the routes' 403 body
 *  (substrate backstop, so even a buggy/old tool build cannot fail open). */
export declare const UNIDENTIFIED_TOOL_CALL_ERROR: string;
/**
 * Return the gateway-side capability for a session. The per-instance key is
 * persisted, but never propagated to engine children; only the derived,
 * session-scoped capability leaves the gateway. Determinism keeps warm/resumed
 * MCP servers valid across gateway process replacement.
 */
export declare function ensureSessionCapability(sessionId: string, keyFile?: string): string;
export declare function verifySessionCapability(sessionId: string, capability: string, keyFile?: string): boolean;
/**
 * Return a copy of a resolved MCP server set with the session's id and bound
 * capability added to the built-in `jinn` server's env. Never mutates the input
 * (the resolver's output may be shared/cached by callers). No-op when the set
 * has no stdio `jinn` server (gateway MCP disabled, or a URL-based custom
 * server shadowing is impossible — the name is reserved).
 */
export declare function attachSessionIdentity(resolved: ResolvedMcpConfig, sessionId: string, options?: {
    workflowAttempt?: boolean;
}): ResolvedMcpConfig;
//# sourceMappingURL=identity.d.ts.map