/**
 * The `defineIdentity(...)` input, and its normalization into the resolved
 * {@link IdentityConfig}.
 *
 * Authors describe how callers authenticate. The runtime supplies the managed
 * user-isolation policy, so credential ownership does not become an authoring
 * knob. Durable memory is not an identity concern at all — it has its own root
 * declaration in `memory.ts`.
 */
import type { IdentityConfig, LangSmithApiKeyIngress, ValidatedTokenProvider } from "./types.js";
/**
 * How MDA learns who is calling.
 *
 * - `"backend"` — a backend you operate has already authenticated the caller and
 *   asserts the user id over the reserved ingress headers.
 * - `auth.langsmithApiKey()` — MDA verifies a LangSmith workspace API key and
 *   treats the result as a service identity.
 * - one or more `providers.*` entries — MDA verifies the caller's own token
 *   server-side (browser-direct).
 */
export type IdentityAuth = "backend" | LangSmithApiKeyIngress | ValidatedTokenProvider | ValidatedTokenProvider[];
/** The identity declaration. Authentication must be chosen explicitly. */
export interface IdentityOptions {
    /** How callers authenticate. */
    auth: IdentityAuth;
}
/**
 * Derive the resolved {@link IdentityConfig} from the declared options.
 *
 * Pure and total: every reachable option combination produces a config that
 * `validateIdentity` accepts, so the errors that exist only to police two
 * fields agreeing with each other are unreachable from this path.
 */
export declare function normalizeIdentity(options: IdentityOptions): IdentityConfig;
//# sourceMappingURL=options.d.ts.map