/**
 * identity — outbound credential vending for agent tools.
 *
 * The {@link CredentialProvider} port + adapters. A tool calls
 * `provider.getCredential({ service })` to get a token for a downstream service;
 * `agentCoreIdentity()` backs it with AWS Bedrock AgentCore Identity, or
 * `staticTokens()` for dev/test.
 *
 * SECURITY: a vended token is a secret — use it locally inside a tool's
 * `execute` (e.g. an HTTP header); never write it to tracked scope. See
 * `./identity/types` for the full invariant.
 *
 * @example
 * ```ts
 * import { agentCoreIdentity } from 'agentfootprint/security';
 *
 * const credentials = agentCoreIdentity({ region: 'us-east-1' });
 * const r = await credentials.getCredential({ service: 'github', mode: 'user', scopes: ['repo'] });
 * if (r.status === 'authorization-required') {
 *   // surface r.authorizationUrl to the user (e.g. pause the run), then retry.
 * } else {
 *   callGitHub({ headers: r.credential.toHeaders() }); // universal applicator
 * }
 * ```
 *
 * Not an import path of its own since 9.0.0. This is the implementation barrel
 * behind `agentfootprint/security`, which re-exports every name here — same
 * symbols, one door. Import from the door.
 */
export type { Credential, CredentialProvider, CredentialRequest, CredentialResult, CredentialIssued, CredentialAuthorizationRequired, CredentialNeed, } from './identity/types.js';
export { isCredentialIssued, unconfiguredCredentialProvider } from './identity/types.js';
export { bearer, apiKey, basic, headers, type BearerCredential, type ApiKeyCredential, type BasicCredential, type HeadersCredential, } from './identity/kinds.js';
export { staticTokens, type StaticTokensOptions } from './identity/staticTokens.js';
export type { AuthorizationRequiredMode, ConsentRequest } from './identity/consent.js';
export { CredentialConsentRequiredError, type CredentialConsentRequiredContext, } from './identity/CredentialConsentRequiredError.js';
export { withCredentialRetry, type WithCredentialRetryOptions, } from './identity/withCredentialRetry.js';
export { agentCoreIdentity, completeAgentCoreAuthorization, type AgentCoreIdentityOptions, type AgentCoreIdentityClientLike, type AgentCoreOauthResponse, type CompleteAgentCoreAuthorizationOptions, } from './adapters/identity/agentcore.js';
export { vaultCredentials, type VaultCredentialsOptions } from './adapters/identity/vault.js';
export { googleIdentity, CLOUD_PLATFORM_SCOPE, type GoogleIdentityOptions, type GoogleImpersonation, type GoogleAuthClientLike, } from './adapters/identity/google.js';
export { entraIdentity, AZURE_AI_SCOPE, AZURE_MANAGEMENT_SCOPE, AZURE_COGNITIVE_SERVICES_SCOPE, type EntraIdentityOptions, type TokenCredentialLike, type AccessTokenLike, type AzureIdentitySdkModule, } from './adapters/identity/azure.js';
export { jwksIdentity, MissingJwksSupportError, type JoseBackend, type JwksIdentityOptions, } from './adapters/identity/jwks.js';
//# sourceMappingURL=identity.d.ts.map