/**
 * AsyncLocalStorage-backed carrier for the current request's caller
 * identity. The HTTP transport populates this on every authenticated
 * request; the tool dispatcher reads it to decide which grant to
 * consult and to tag audit rows. Stdio callers (the Claude Desktop
 * default) don't populate it — the dispatcher treats a missing context
 * as the local/trusted caller and bypasses the grant gate.
 *
 * AsyncLocalStorage propagates through awaited async calls within the
 * same request, so the dispatcher can read the context without needing
 * it threaded through every function.
 */
/**
 * Derive a stable per-agent id for a LOCAL (stdio) client from its self-reported
 * MCP client name. Local agents have no OAuth client_id, so we key their grant
 * on the name (lowercased) — this is a local-trust convenience ("remember this
 * client across relaunches"), NOT a cryptographic identity (the name is
 * self-reported and could be spoofed by another local process). The `stdio:`
 * prefix namespaces it from OAuth ids (`pmc_…`) in the shared grant store.
 */
export declare function localAgentId(clientName: string): string;
export interface CallerContext {
    /** OAuth client_id of the caller (DCR `pmc_…` for interactive agents and
     *  service accounts, `stdio:…` for local stdio agents). Always a real,
     *  per-agent identity — there is no shared-bearer pseudo-client. */
    clientId: string;
    /** Human-readable display name (from DCR/service-account client_name or synthesized). */
    clientName: string;
    /** Remote IP when known; undefined for stdio callers. */
    ip?: string;
}
export declare function runWithCaller<T>(ctx: CallerContext, fn: () => T | Promise<T>): T | Promise<T>;
export declare function currentCaller(): CallerContext | undefined;
//# sourceMappingURL=caller-context.d.ts.map