/**
 * Environment-Based Source Inference
 *
 * Detects caller identity from process environment variables instead of
 * relying on the MCP client to self-declare. The MCP server process inherits
 * the parent's environment, which isn't forgeable via MCP tool parameters.
 *
 * This addresses Phase 1 limitation: "security is opt-in" — with env detection,
 * Claude Code agents get correct trust automatically with zero configuration.
 */
import type { DefenceSource } from '../types.js';
export interface EnvDetectionResult {
    source: DefenceSource;
    method: 'env:CLAUDE_CODE_ENTRYPOINT' | 'env:CLAUDE_AGENT_CONTEXT' | 'env:CODEX_INTERNAL_ORIGINATOR_OVERRIDE' | 'env:CODEX_THREAD_ID' | 'env:SHIELDCORTEX_AGENT_SOURCE' | 'default';
    confidence: 'high' | 'medium' | 'low';
}
/**
 * Infer caller source from process environment variables.
 *
 * Priority order:
 * 1. SHIELDCORTEX_AGENT_SOURCE — explicit override (e.g. "agent:user-spawned>task-1")
 * 2. CLAUDE_CODE_ENTRYPOINT=subagent — Claude Code sub-agent
 * 3. CLAUDE_AGENT_CONTEXT — generic agent context marker
 * 4. Codex origin / thread vars — Codex CLI or VS Code extension
 * 5. CLAUDE_CODE_ENTRYPOINT present (any value) — direct Claude Code CLI
 * 6. No recognised env vars → agent:unknown (trust ~0.3, treated as untrusted agent)
 */
export declare function inferSourceFromEnvironment(): EnvDetectionResult;
/**
 * Resolve the effective source for an MCP tool call.
 *
 * If the caller explicitly passes a source, use it.
 * Otherwise, infer from environment.
 *
 * @param declaredSource - Source passed by the MCP client (may be undefined)
 * @param strictMode - If true, unknown sources get lower trust
 * @returns The resolved source and whether it was inferred
 */
export declare function resolveSource(declaredSource?: DefenceSource, strictMode?: boolean): {
    source: DefenceSource;
    inferred: boolean;
    detection?: EnvDetectionResult;
};
