/**
 * Resolve a provider API key using OpenClaw's own auth resolution system.
 *
 * This module delegates to the gateway's `resolveApiKeyForProvider()` function,
 * which handles all secret reference formats (SecretRef objects, auth profiles,
 * "secretref-managed" markers, environment variables, etc.) using the same
 * codepath the gateway uses for its own agent sessions.
 *
 * For plain-text API keys, a fast path returns them directly without
 * involving the gateway auth system.
 *
 * Results are cached per provider for the gateway process lifetime.
 */
type ResolveApiKeyFn = (params: {
    provider: string;
    cfg?: unknown;
    agentDir?: string;
}) => Promise<{
    apiKey?: string;
    source?: string;
    mode?: string;
} | null>;
/**
 * Resolve request-ready auth for a model, including provider-owned transforms
 * (e.g., OAuth token exchange, base URL override for openai-codex).
 */
type GetRuntimeAuthForModelFn = (params: {
    model: {
        provider: string;
        id: string;
        api?: string;
        baseUrl?: string;
    };
    cfg?: unknown;
    workspaceDir?: string;
}) => Promise<{
    apiKey?: string;
    baseUrl?: string;
    source?: string;
    mode?: string;
    profileId?: string;
} | null>;
/**
 * Discover gateway runtime module files matching the given filename prefix.
 *
 * Reused by adjacent SecretRef resolution code (`resolve-auth-token.ts`,
 * issue #757). Walks the same dist-dir candidates as the model-auth path
 * so callers don't reimplement install-method discovery.
 */
declare function findGatewayRuntimeModules(filePrefix: string): Promise<string[]>;
declare function findExecutableOnPath(executableName: string, access: (path: string, mode?: number) => void, stat: (path: string) => {
    isFile(): boolean;
}, executableMode: number): string | undefined;
declare const __findExecutableOnPathForTest: typeof findExecutableOnPath;
/**
 * Resolve a provider API key from various OpenClaw formats.
 *
 * Resolution order:
 * 1. Plain-text string → returned immediately
 * 2. Gateway's resolveApiKeyForProvider → handles all secret ref formats
 * 3. Environment variable fallback (PROVIDER_NAME_API_KEY)
 * 4. undefined → provider is skipped in the fallback chain
 */
declare function resolveProviderApiKey(providerId: string, apiKeyValue: unknown, gatewayConfig?: unknown, agentDir?: string): Promise<string | undefined>;
/**
 * Get the gateway's getRuntimeAuthForModel function, if available.
 * This resolves request-ready auth including provider-owned transforms
 * (OAuth token exchange, base URL override for codex/copilot/etc.).
 * Must be called after at least one resolveProviderApiKey() call to
 * trigger the lazy module load.
 */
declare function getGatewayRuntimeAuthForModel(): Promise<GetRuntimeAuthForModelFn | null>;
/**
 * Clear the resolution cache (useful for testing or key rotation).
 */
declare function clearSecretCache(): void;
declare function __setGatewayResolverForTest(resolver: ResolveApiKeyFn | null): void;
declare function __setGatewayRuntimeAuthForModelForTest(resolver: GetRuntimeAuthForModelFn | null): void;

export { type GetRuntimeAuthForModelFn, __findExecutableOnPathForTest, __setGatewayResolverForTest, __setGatewayRuntimeAuthForModelForTest, clearSecretCache, findGatewayRuntimeModules, getGatewayRuntimeAuthForModel, resolveProviderApiKey };
