/**
 * credential-availability.ts, client-side credential-status read.
 *
 * When a surface product acts as a CLIENT of an adopted external daemon (the
 * host-service `mode === 'external'` topology), provider/model/secret STATUS is
 * read from that daemon's `credentials.get` wire method rather than from the
 * surface's own scoped store. This module folds a `credentials.get` outcome into
 * an honest availability value, the one contract every surface renders from:
 *
 *   - a 503 CREDENTIAL_STORE_UNAVAILABLE (matched by machine code), a METHOD_NOT_FOUND
 *     from an older daemon, or ANY transport failure  ->  { available: false, reason }
 *    , an honest, reason-carrying "unavailable" state.
 *   - NEVER a fabricated "configured"; NEVER a secret byte. Only the boolean status
 *     metadata surface (key / configured / usable / source / secure) is carried.
 *
 * STATUS ONLY moves to the daemon path. Secret RESOLUTION, the value-reads provider
 * auth needs, plus the env-only API-key posture, stays local and is untouched by
 * this module. The daemon's `credentials.get` never returns raw key bytes over the
 * wire (see the SDK decision record 2026-07-06-config-sharing-shared-tier-and-secret-read),
 * so no plaintext can reach a caller through this path by construction.
 */
/** One credential's status metadata from the daemon's shared store, never bytes. */
export interface CredentialStatusEntry {
    readonly key: string;
    readonly configured: boolean;
    readonly usable: boolean;
    readonly source?: string | undefined;
    readonly secure?: boolean | undefined;
}
/** Honest availability: either a status list, or a reason we could not read it. */
export type CredentialAvailability = {
    readonly available: true;
    readonly credentials: readonly CredentialStatusEntry[];
} | {
    readonly available: false;
    readonly reason: string;
};
/** A `credentials.get` invocation outcome, success value OR a thrown error. */
export type CredentialStatusOutcome = {
    readonly ok: true;
    readonly value: unknown;
} | {
    readonly ok: false;
    readonly error: unknown;
};
/** Credential-read posture: read the daemon's shared store, or the local own store. */
export type CredentialReadMode = 'host' | 'client';
/**
 * Map the authoritative host-service mode string to the credential-read posture.
 * Only 'external' (a separately-running daemon this surface adopted) reads
 * credential STATUS over the wire; every other mode ('embedded'/'disabled'/
 * 'blocked'/'incompatible'/'unavailable') is the local host reading its own store.
 */
export declare function credentialReadModeFromHostMode(hostMode: string): CredentialReadMode;
/**
 * Fold a `credentials.get` outcome into an honest availability value. Mirrors
 * the wire contract exactly: any failure becomes a
 * reason-carrying `available: false`; a malformed success (no credentials array)
 * is treated as unavailable rather than fabricated as configured; on success only
 * the boolean status surface is carried, never a secret value.
 */
export declare function deriveCredentialAvailability(outcome: CredentialStatusOutcome): CredentialAvailability;
/**
 * Client-side credential-status read. Invokes the adopted external daemon's
 * `credentials.get` and folds success OR any thrown transport/daemon error into an
 * honest availability. The daemon's `credentials.get` transport error carries the
 * machine `code` at the top level (e.g. an HttpStatusError whose body supplied
 * `CREDENTIAL_STORE_UNAVAILABLE` / `METHOD_NOT_FOUND`), which `deriveCredentialAvailability`
 * classifies. Only the boolean status surface is returned; a raw secret value can
 * never reach a caller through this path.
 */
export declare function readClientCredentialStatus(invokeCredentialsGet: () => Promise<unknown>): Promise<CredentialAvailability>;
//# sourceMappingURL=credential-availability.d.ts.map