/**
 * Outbound Delegation Header Injection
 *
 * Wraps globalThis.fetch to inject delegation proof headers on outbound
 * HTTP requests made during delegated tool handler execution.
 *
 * Reads delegation context from AsyncLocalStorage (via getContext()),
 * builds a signed Ed25519 JWT, and injects the canonical KYA-OS-* Layer 2
 * delegation headers:
 *   KYA-OS-Delegation-Chain, KYA-OS-Delegation-Proof, KYA-OS-Granted-Scopes,
 *   and KYA-OS-Delegation-Credential when a DelegationCredential VC is present.
 *
 * Behavior:
 * - Skips injection for internal hostnames (localhost, *.vouched.id, Fly IPs)
 * - On signing failure: logs warning, continues WITHOUT delegation headers
 * - Anonymous/non-delegated calls: no headers injected
 *
 * Related Spec: DIF MCP-I §8 — Outbound Delegation Propagation
 */
interface Logger {
    debug: (msg: string, meta?: Record<string, unknown>) => void;
    warn: (msg: string, meta?: Record<string, unknown>) => void;
}
/**
 * Determine if a URL is an internal request that should not carry
 * delegation headers. Matches the same guard as the compute interceptor.
 */
export declare function isInternalDelegationTarget(urlString: string): boolean;
/**
 * Install the delegation header interceptor on globalThis.fetch.
 * Returns a teardown function that restores the original fetch.
 *
 * Idempotent — calling multiple times is safe.
 */
export declare function installDelegationInterceptor(logger?: Logger): () => void;
export {};