/**
 * Common interface for credential providers (Keychain, etc.).
 *
 * Providers return a raw secret. They are ONLY invoked by the bridge; callers
 * outside this module should go through CredentialBridge, which puts the
 * secret into the short-lived store and returns a handle.
 */
export interface CredentialLookup {
    host: string;
    /** Optional — for sites with multiple accounts. If omitted, provider picks the "first" match. */
    account?: string;
}
export type CredentialResult = {
    ok: true;
    value: string;
    account?: string;
} | {
    ok: false;
    reason: "not_found" | "denied" | "unsupported" | "error";
    message: string;
};
export interface CredentialProvider {
    readonly name: string;
    lookup(q: CredentialLookup): Promise<CredentialResult>;
}
//# sourceMappingURL=credential-provider.d.ts.map