import type { AgentId } from './types.js';
export type AccountAuthKind = 'api-key' | 'setup-token' | 'bearer-token';
export interface AccountProviderAdapter {
    provider: string;
    authKinds: readonly AccountAuthKind[];
    envFor(host: AgentId, kind: AccountAuthKind): string;
    connectionEnvFor(host: AgentId): Record<string, string>;
    /**
     * The env var a per-account BASE_URL override should be written to for this
     * host, or null when the provider has no endpoint env on that host. Derived
     * from the provider's own connection env so the base-url key lives in one
     * place instead of being re-guessed by callers.
     */
    baseUrlEnvFor(host: AgentId): string | null;
    validate(kind: AccountAuthKind, value: string): void;
}
export declare function getAccountProvider(provider: string): AccountProviderAdapter;
/**
 * Whether a provider account of kind `auth` can authenticate `agent` — i.e. the
 * adapter has an `envFor(agent, auth)` mapping. Used both by the account UI and by
 * the run-candidate pool so a Cursor key never enters Claude's pool and a harness
 * with no provider adapter at all (e.g. kimi, native-login only) yields nothing.
 * A "cannot authenticate" is a clean false; any other error (unknown provider,
 * unsupported kind) is a real bug and re-throws rather than being swallowed.
 */
export declare function providerAuthenticatesHarness(provider: string, auth: AccountAuthKind, agent: AgentId): boolean;
export declare function listAccountProviders(): string[];
