import type { ActorConfig } from './types.js';
export type ActorKind = 'human' | 'agent';
export interface ResolvedActor {
    /**
     * Stable id for the responsible entity: the tailnet login (usually an email)
     * for a resolved human, or `UNRESOLVED@<host>` when it can't be determined.
     */
    id: string;
    kind: ActorKind;
    /** Human-readable name, for git author + display. */
    name?: string;
    /** Email, for git author + as a durable key. */
    email?: string;
    /** GitHub handle, when the actors map records one. */
    github?: string;
    /**
     * Phoenix (work) identity id for this human, when the actors map records one.
     * Bridges a personal tailnet login (e.g. a personal gmail) to the stable
     * internal work identity, so attribution survives whichever email a person
     * happens to be signed into tailscale with.
     */
    phoenixId?: string;
}
/** Result of `tailscale whois --json <ip>` we care about. */
export interface WhoisIdentity {
    login?: string;
    displayName?: string;
}
/**
 * Map a resolved tailnet identity (+ the actors map) to a ResolvedActor. Pure --
 * the impure whois/config reads happen in computeActor -- so the enrich/override
 * path is fully testable. No login (local, or an unnameable peer) yields the
 * honest `UNRESOLVED@<host>`; a login without a config entry still credits git
 * from the tailnet DisplayName + login email.
 */
export declare function actorFromIdentity(who: WhoisIdentity | undefined, host: string, actors: Record<string, ActorConfig>): ResolvedActor;
/**
 * Injectable tailscale resolvers, so tests can drive the SSH-whois and
 * local-self branches deterministically without a real tailscale on the box
 * (a dev machine that *is* on the tailnet would otherwise make the local path
 * non-deterministic). Production callers use the defaults.
 */
export interface ActorResolvers {
    whois: (ip: string) => WhoisIdentity | undefined;
    self: () => WhoisIdentity | undefined;
}
/**
 * Compute the actor for a given environment. The only impurity is the tailscale
 * shell-out (injectable via `resolvers`), so tests drive every branch explicitly.
 *
 * Resolution order: an inherited env actor wins; otherwise an SSH run whois-es
 * its client IP; a local run (no SSH) credits the device's own tailnet owner;
 * and anything unresolvable degrades to `UNRESOLVED@<host>`. Note the self
 * fallback fires ONLY for a truly local run — an SSH run whose whois fails must
 * NOT be credited to the box owner (that would misattribute a remote human to
 * whoever owns the machine).
 */
export declare function computeActor(env?: NodeJS.ProcessEnv, resolvers?: ActorResolvers): ResolvedActor;
/**
 * Resolve the actor for the current process, cached for the process lifetime
 * (the SSH `whois` shell-out runs at most once).
 */
export declare function resolveActor(): ResolvedActor;
/**
 * Test-only: pin the tailscale resolvers `resolveActor()` uses, so a test that
 * exercises the cached production entrypoint (e.g. `withActorEnv()`) is isolated
 * from whether the box running it is on the tailnet. `computeActor` already takes
 * injected resolvers for its unit tests; this extends the same seam to the cached
 * path. Pass `undefined` to restore the real tailscale resolvers. Resets the
 * cache so the next `resolveActor()` recomputes under the new resolvers.
 */
export declare function setActorResolvers(resolvers: ActorResolvers | undefined): void;
/** Clear the per-process cache. For tests, and for env changes within a run. */
export declare function resetActorCache(): void;
/**
 * The env an actor propagates to child processes. Always carries the actor id +
 * kind (so children inherit and don't re-resolve). For a resolved human with a
 * real name and email, it also carries `GIT_AUTHOR_*` / `GIT_COMMITTER_*` so the
 * agent's own commits are credited to the person, not the shared account. An
 * unresolved actor sets no git identity -- git keeps its ambient config.
 */
export declare function actorEnv(actor: ResolvedActor): Record<string, string>;
