import type { RuntimeChannel } from "../channels/types.js";
import type { RuntimeIdentity } from "../identity/index.js";
import type { ConfigurableCarrier } from "./types.js";
/** Override ambient LangGraph configurable resolution. Test-only. */
export declare function setAmbientConfigurableForTests(loader?: () => Record<string, unknown> | undefined): void;
/**
 * Resolve the LangGraph `configurable` bag from either a flat runtime or the
 * nested `ToolRuntime` shape LangChain passes to tools
 * (`runtime.config.configurable`).
 *
 * When the caller only passes `{ state }` (or omits auth), fall back to the
 * ambient LangGraph runnable config so `langgraph_auth_user` still reaches
 * tools and middleware.
 *
 * Also fall back when a runtime `config` is present but its `configurable` bag
 * lacks `langgraph_auth_user` (empty or partial). Returning that bag would skip
 * ambient and leave the first turn without a resolved caller identity.
 */
export declare function resolveRuntimeConfigurable(runtime: RuntimeConfigLike | undefined): Record<string, unknown> | undefined;
/** Read `configurable` from a flat runtime or nested `ToolRuntime.config`. */
export declare function configurableFromRuntime(runtime: RuntimeConfigLike | undefined): Record<string, unknown> | undefined;
/** `configurable` from the running LangGraph node, if any. */
export declare function resolveAmbientConfigurable(): Record<string, unknown> | undefined;
/**
 * Build the frozen identity envelope for the current run from the trusted
 * `langgraph_auth_user` the custom-auth handler produced. Returns
 * `undefined` when the deployment has no resolvable user (identity is opt-in).
 *
 * LangGraph Studio injects a `StudioUser` (no `mda_user_id`) when
 * `x-auth-scheme: langsmith` is present; that maps to a service principal with
 * `source.provider: "studio"` so user-scoped memory/credentials still resolve
 * during local Studio runs.
 */
export declare function buildRuntimeIdentity(configurable: Record<string, unknown> | undefined): RuntimeIdentity | undefined;
/**
 * The runtime the managed seam sees: the shared `configurable` carrier, plus the
 * optional nested `config` (e.g. LangGraph `ToolRuntime.config`) and the frozen
 * `identity` envelope the seam layers on. Single source for the tool and
 * middleware helpers.
 */
export interface RuntimeConfigLike extends ConfigurableCarrier {
    identity?: RuntimeIdentity;
    channel?: RuntimeChannel;
    config?: {
        configurable?: Record<string, unknown>;
    };
}
/**
 * Strip client-supplied identity keys from an incoming `configurable` so a
 * request body can never spoof the user the handler resolved. The platform-set
 * `langgraph_auth_user` is preserved — it is the only trusted source. Retired
 * organization/tenant keys stay reserved so they cannot be reintroduced as
 * spoofable fields.
 */
export declare function sanitizeConfigurable(configurable: Record<string, unknown> | undefined): Record<string, unknown>;
//# sourceMappingURL=identity-runtime.d.ts.map