import { i as OpenClawConfig } from "./types.openclaw-BC41dhLQ.js";
import { f as Model } from "./types-CZAevFX5.js";
import { i as AuthProfileCredential, s as AuthProfileStore } from "./types-B7NmUD7r.js";
import { t as ProviderAuthEvidence } from "./provider-env-vars-aknUNGpH.js";

//#region src/agents/model-auth-env.d.ts
type EnvApiKeyResult = {
  apiKey: string;
  source: string;
};
type EnvApiKeyLookupOptions = {
  config?: OpenClawConfig;
  workspaceDir?: string;
  aliasMap?: Readonly<Record<string, string>>;
  candidateMap?: Readonly<Record<string, readonly string[]>>;
  authEvidenceMap?: Readonly<Record<string, readonly ProviderAuthEvidence[]>>;
  skipSetupProviderFallback?: boolean;
};
declare function resolveEnvApiKey(provider: string, env?: NodeJS.ProcessEnv, options?: EnvApiKeyLookupOptions): EnvApiKeyResult | null;
//#endregion
//#region src/agents/model-auth-runtime-shared.d.ts
type ResolvedProviderAuth = {
  apiKey?: string;
  profileId?: string;
  source: string;
  mode: "api-key" | "oauth" | "token" | "aws-sdk";
};
type ProviderAuthErrorCode = "missing-api-key" | "missing-provider-auth";
declare class ProviderAuthError extends Error {
  readonly code: ProviderAuthErrorCode;
  readonly provider: string;
  constructor(code: ProviderAuthErrorCode, provider: string, message: string);
}
declare class MissingProviderAuthError extends ProviderAuthError {
  readonly mode: ResolvedProviderAuth["mode"];
  readonly source: string;
  constructor(provider: string, auth: ResolvedProviderAuth);
}
declare function isProviderAuthError(err: unknown, code?: ProviderAuthErrorCode): err is ProviderAuthError;
declare function isMissingProviderAuthError(err: unknown): err is MissingProviderAuthError;
declare function resolveAwsSdkEnvVarName(env?: NodeJS.ProcessEnv): string | undefined;
declare function formatMissingAuthError(auth: ResolvedProviderAuth, provider: string): string;
declare function requireApiKey(auth: ResolvedProviderAuth, provider: string): string;
//#endregion
//#region src/agents/model-auth.d.ts
type ProviderCredentialPrecedence = "profile-first" | "env-first";
type RuntimeProviderAuthLookup = {
  envApiKey: Pick<EnvApiKeyLookupOptions, "aliasMap" | "candidateMap" | "authEvidenceMap" | "skipSetupProviderFallback">;
  setupProviderFallbackRefs?: readonly string[];
  syntheticAuthProviderRefs?: readonly string[];
  syntheticAuthProviderRefsComplete?: boolean;
};
declare function createRuntimeProviderAuthLookup(params: {
  cfg?: OpenClawConfig;
  workspaceDir?: string;
  env?: NodeJS.ProcessEnv;
  includePluginSyntheticAuth?: boolean;
}): RuntimeProviderAuthLookup;
declare function getCustomProviderApiKey(cfg: OpenClawConfig | undefined, provider: string): string | undefined;
type ResolvedCustomProviderApiKey = {
  apiKey: string;
  source: string;
};
declare function resolveUsableCustomProviderApiKey(params: {
  cfg: OpenClawConfig | undefined;
  provider: string;
  env?: NodeJS.ProcessEnv;
}): ResolvedCustomProviderApiKey | null;
declare function hasUsableCustomProviderApiKey(cfg: OpenClawConfig | undefined, provider: string, env?: NodeJS.ProcessEnv): boolean;
declare function shouldPreferExplicitConfigApiKeyAuth(cfg: OpenClawConfig | undefined, provider: string): boolean;
type ProviderEntryApiKeyProfileReference = {
  kind: "none";
} | {
  kind: "literal";
  apiKey: string;
  source: string;
} | {
  kind: "profile";
  profileId: string;
  credential: AuthProfileCredential;
  mode: ResolvedProviderAuth["mode"];
} | {
  kind: "profile-incompatible";
  profileId: string;
  credentialProvider: string;
  credentialType: AuthProfileCredential["type"];
  reason: "credential-class" | "provider-binding";
} | {
  kind: "marker";
};
type ProviderEntryApiKeyBindingResolution = {
  kind: "none";
} | {
  kind: "literal";
  apiKey: string;
  source: string;
} | {
  kind: "profile-resolved";
  auth: ResolvedProviderAuth;
} | {
  kind: "profile-incompatible";
  profileId: string;
  credentialProvider: string;
  credentialType: AuthProfileCredential["type"];
  reason: "credential-class" | "provider-binding";
} | {
  kind: "profile-unresolved";
  profileId: string;
  error?: unknown;
};
declare function canUseProfileAsProviderEntryApiKey(params: {
  cfg?: OpenClawConfig;
  provider: string;
  credential: AuthProfileCredential;
}): boolean;
declare function resolveProviderEntryApiKeyProfileReference(params: {
  cfg?: OpenClawConfig;
  provider: string;
  store: AuthProfileStore;
}): ProviderEntryApiKeyProfileReference;
declare function resolveProviderEntryApiKeyBinding(params: {
  cfg?: OpenClawConfig;
  provider: string;
  store: AuthProfileStore;
  agentDir?: string;
}): Promise<ProviderEntryApiKeyBindingResolution>;
declare function hasSyntheticLocalProviderAuthConfig(params: {
  cfg: OpenClawConfig | undefined;
  provider: string;
}): boolean;
declare function hasRuntimeAvailableProviderAuth(params: {
  provider: string;
  cfg?: OpenClawConfig;
  workspaceDir?: string;
  env?: NodeJS.ProcessEnv;
  allowPluginSyntheticAuth?: boolean;
  runtimeLookup?: RuntimeProviderAuthLookup;
  modelApi?: string;
}): boolean;
declare function resolveApiKeyForProvider(params: {
  provider: string;
  cfg?: OpenClawConfig;
  profileId?: string;
  preferredProfile?: string;
  store?: AuthProfileStore;
  agentDir?: string;
  workspaceDir?: string;
  /** When true, treat profileId as a user-locked selection that must not be
   *  silently overridden by env/config credentials. */
  lockedProfile?: boolean;
  forceRefresh?: boolean;
  credentialPrecedence?: ProviderCredentialPrecedence;
  modelApi?: string;
}): Promise<ResolvedProviderAuth>;
type ModelAuthMode = "api-key" | "oauth" | "token" | "mixed" | "aws-sdk" | "unknown";
declare function resolveModelAuthMode(provider?: string, cfg?: OpenClawConfig, store?: AuthProfileStore, options?: {
  workspaceDir?: string;
}): ModelAuthMode | undefined;
declare function hasAvailableAuthForProvider(params: {
  provider: string;
  cfg?: OpenClawConfig;
  preferredProfile?: string;
  store?: AuthProfileStore;
  agentDir?: string;
  workspaceDir?: string;
  modelApi?: string;
}): Promise<boolean>;
declare function getApiKeyForModel(params: {
  model: Model;
  cfg?: OpenClawConfig;
  profileId?: string;
  preferredProfile?: string;
  store?: AuthProfileStore;
  agentDir?: string;
  workspaceDir?: string;
  lockedProfile?: boolean;
  credentialPrecedence?: ProviderCredentialPrecedence;
}): Promise<ResolvedProviderAuth>;
declare function applyLocalNoAuthHeaderOverride<T extends Model>(model: T, auth: ResolvedProviderAuth | null | undefined): T;
/**
 * When the provider config sets `authHeader: true`, inject an explicit
 * `Authorization: Bearer <apiKey>` header into the model so downstream SDKs
 * (e.g. `@google/genai`) send credentials via the standard HTTP Authorization
 * header instead of vendor-specific headers like `x-goog-api-key`.
 *
 * This is a no-op when `authHeader` is not `true`, when no API key is
 * available, or when the API key is a synthetic marker (e.g. local-server
 * placeholders) rather than a real credential.
 */
declare function applyAuthHeaderOverride<T extends Model>(model: T, auth: ResolvedProviderAuth | null | undefined, cfg: OpenClawConfig | undefined): T;
//#endregion
export { resolveEnvApiKey as A, ResolvedProviderAuth as C, requireApiKey as D, isProviderAuthError as E, resolveAwsSdkEnvVarName as O, ProviderAuthError as S, isMissingProviderAuthError as T, resolveProviderEntryApiKeyBinding as _, applyAuthHeaderOverride as a, shouldPreferExplicitConfigApiKeyAuth as b, createRuntimeProviderAuthLookup as c, hasAvailableAuthForProvider as d, hasRuntimeAvailableProviderAuth as f, resolveModelAuthMode as g, resolveApiKeyForProvider as h, RuntimeProviderAuthLookup as i, EnvApiKeyResult as k, getApiKeyForModel as l, hasUsableCustomProviderApiKey as m, ProviderCredentialPrecedence as n, applyLocalNoAuthHeaderOverride as o, hasSyntheticLocalProviderAuthConfig as p, ProviderEntryApiKeyBindingResolution as r, canUseProfileAsProviderEntryApiKey as s, ModelAuthMode as t, getCustomProviderApiKey as u, resolveProviderEntryApiKeyProfileReference as v, formatMissingAuthError as w, MissingProviderAuthError as x, resolveUsableCustomProviderApiKey as y };