import type { SecretsBundle } from './secrets/bundles.js';
import type { AccountAuthKind } from './account-provider-registry.js';
/** Canonical bundle variable names for a provider-account bundle. */
export declare const ACCOUNT_VARS: {
    readonly id: "ACCOUNT_ID";
    readonly provider: "PROVIDER";
    readonly authType: "AUTH_TYPE";
    readonly baseUrl: "BASE_URL";
    readonly apiKey: "API_KEY";
    readonly token: "TOKEN";
};
/**
 * Account bundles are stored with the `never` prompt policy: no biometry ACL,
 * so reads are silent and the bundle syncs across the fleet without Touch ID.
 */
export declare const ACCOUNT_POLICY: "never";
/** The parsed identity of an account, independent of where its bytes live. */
export interface AccountSchemaRecord {
    id: string;
    name: string;
    provider: string;
    auth: AccountAuthKind;
    baseUrl?: string;
}
/** The single secret var name that carries the credential for an auth kind. */
export declare function secretVarFor(auth: AccountAuthKind): 'API_KEY' | 'TOKEN';
/** The keychain item that stores an account bundle's secret value. */
export declare function accountSecretItem(name: string, auth: AccountAuthKind): string;
/**
 * Build the canonical account bundle plus the keychain item map holding its
 * secret. The identity vars are literals; the secret var is a `keychain:` ref
 * whose value lives in the returned item map, ready for `writeBundleWithItems`.
 */
export declare function buildAccountBundle(record: AccountSchemaRecord, secret: string): {
    bundle: SecretsBundle;
    items: Map<string, string>;
};
/**
 * Parse an account record from a bundle, or null when the bundle is not an
 * account bundle (missing ACCOUNT_ID / PROVIDER / a known AUTH_TYPE). The
 * catalog uses the null return to keep ordinary secrets bundles out of the
 * account list.
 */
export declare function parseAccountBundle(bundle: SecretsBundle): AccountSchemaRecord | null;
