"""CredentialProvider - scoped/JIT credentials."""
from __future__ import annotations

from typing import Any, Protocol, runtime_checkable


@runtime_checkable
class CredentialProvider(Protocol):
    """Provider pro kratkodobe a scoped credentials.

    Principy v4.1: short-lived, least privilege, scoped, revocable,
    auditable, task-specific, agent-specific.
    """

    async def issue(
        self,
        agent_id: str,
        task_id: str,
        scope: list[str],
        ttl_seconds: int = 3600,
    ) -> dict[str, Any]:
        ...

    async def revoke(self, credential_id: str) -> bool:
        ...