import type { Fs } from "./protocol.js";
/**
 * One parsed credential file. The shape is the broker's §7.1 contract — the
 * worker consumes it verbatim without consulting the snapshot (the broker
 * owns ALL resolution including transport).
 */
export interface CredentialFile {
    /** The resolved MCP URL (may be scoped `<host>/apps/<id>` for federated ggui). */
    url: string;
    /** Transport the broker selected for this server. */
    transport: "http" | "sse";
    /** Headers to forward — typically `{ authorization: 'Bearer <token>' }`. */
    headers: Record<string, string>;
    /** ISO expiry; informational for the worker (the Router refreshes per invoke). */
    expiresAt?: string;
}
/**
 * Read all credential files the Router broker wrote for this invoke. Returns
 * one `{ name, cred }` per valid `.json` file — malformed files are silently
 * skipped (never crash the turn). Missing directory → empty array (no MCP).
 */
export declare function listCredentials(fs: Fs): () => Array<{
    name: string;
    cred: CredentialFile;
}>;
//# sourceMappingURL=creds.d.ts.map