import type { ToolExecutionContext } from "../../tool/index.js";
/** Confirmed request credential identity used by first-party remote tools. */
export type ConfirmedToolExecutionIdentity = {
    authToken: string;
    projectId: string | null;
};
type ResolvedToolExecutionAuthToken = {
    authToken: string;
    fromContext: boolean;
};
/** Resolve an own request auth token, falling back only when the property is absent. */
export declare function resolveToolExecutionAuthToken(context: ToolExecutionContext | undefined, fallbackAuthToken: string, errorContext: string): ResolvedToolExecutionAuthToken;
/** Resolve project identity from the same execution context as its credential. */
export declare function resolveToolExecutionProjectId(context: ToolExecutionContext | undefined, getFallbackProjectId: (() => unknown) | undefined, errorContext: string): string | null;
/**
 * Resolve authorization and project as one credential-owned tuple.
 *
 * A context that owns `authToken` also owns project selection; an absent
 * project is therefore explicitly projectless. Without an own auth token, the
 * complete configured tuple is used so credentials and project identity cannot
 * be combined from different authorities.
 */
export declare function resolveToolExecutionIdentity(context: ToolExecutionContext | undefined, fallbackAuthToken: string, getFallbackProjectId: (() => unknown) | undefined, errorContext: string): ConfirmedToolExecutionIdentity;
/** Validate an optional outbound project identifier. */
export declare function normalizeToolExecutionProjectId(projectId: unknown, errorContext: string): string | null;
/**
 * Snapshot own data context without invoking accessors, then bind credential
 * identity as authoritative own data.
 */
export declare function bindToolExecutionIdentityContext(context: ToolExecutionContext | undefined, identity: ConfirmedToolExecutionIdentity, errorContext: string): ToolExecutionContext | undefined;
export {};
//# sourceMappingURL=tool-execution-identity.d.ts.map