export type ResolvedCredentials = Record<string, string | number | boolean>;

export interface EncryptedVaultEntry {
  provider_id: string;
  version: number;
  iv: string;           // base64 12 bytes
  tag: string;          // base64 16 bytes auth tag
  ciphertext: string;   // base64 AES-256-GCM ciphertext
  meta: Record<string, string | number | boolean>; // non-secret fields (host, port, etc.)
  rotated_at: number;
  uses: number;
  last_used?: number;
}

export interface EncryptedVaultFile {
  format_version: number;
  updated_at: number;
  entries: Record<string, EncryptedVaultEntry>;
}