/**
 * Registration-time credential-authority contract, the structural
 * enforcement half of the ONE request-time credential resolver.
 *
 * Every provider registered through ProviderRegistry.register() must declare
 * how its credentials are obtained (LLMProvider.credentialAuthority:
 * 'resolver' | 'anonymous' | 'subscription' | 'oauth'). A provider that
 * declares none is REFUSED, fail-closed, exactly like the model-source
 * contract (model-source-contract.ts): an auth path the resolver cannot see
 * is how a status badge stays green while chat 401s.
 */
import type { LLMProvider } from './interface.js';
export type CredentialAuthorityCheckable = Pick<LLMProvider, 'name' | 'credentialAuthority'>;
export interface ProviderCredentialAuthorityViolation {
    readonly provider: string;
    readonly message: string;
}
export declare function verifyProviderCredentialAuthority(provider: CredentialAuthorityCheckable): ProviderCredentialAuthorityViolation | null;
/** Throws when the provider declares no sanctioned credential authority. */
export declare function assertProviderCredentialAuthority(provider: CredentialAuthorityCheckable): void;
//# sourceMappingURL=credential-authority-contract.d.ts.map