import type { MxEnvelopeV1 } from '../envelope';
export interface PrincipalContext {
    /** stable key for policy/rate-limit/replay partitioning */
    principalKey: string;
    kind: 'anon' | 'jwt' | 'service';
    iss?: string;
    sub?: string;
    scopes?: string[];
}
/**
 * Derive a stable principal key.
 *
 * For MVP: if JWT claims exist, key = `${iss}:${sub}`.
 * Otherwise fall back to `anon:<fromRealm>` to ensure some partitioning.
 */
export declare function derivePrincipal(env: MxEnvelopeV1): PrincipalContext;
//# sourceMappingURL=principal.d.ts.map