/**
 * Telegram / Discord / Slack bot-token loading from env var + .env
 * file (CAT.1b — ported from `src.legacy/chat/env-token.ts`, #148).
 *
 * Priority (highest first):
 *   1. process.env.OPENSQUID_TELEGRAM_BOT_TOKEN (or _DISCORD_, _SLACK_)
 *   2. .env file (first match wins):
 *      - $OPENSQUID_ENV_FILE
 *      - ~/.loop/.env
 *      - <OPENSQUID_HOME>/.env   (~/.opensquid/.env by default)
 *      - <cwd>/.env
 *   3. <OPENSQUID_HOME>/config.json chat_connections.<platform>.bot_token
 *      (caller-supplied via `configJsonFallback`)
 *
 * The .env parser supports standard KEY=VALUE lines AND a tolerant
 * "bare token" fallback (single non-comment line, no `=`) — the user
 * may save just the token. Bare tokens are treated as
 * OPENSQUID_TELEGRAM_BOT_TOKEN.
 *
 * NEVER logs the token value. Only logs which SOURCE the active token
 * came from, so operators can debug "which bot is this daemon
 * actually using" without leaking the secret.
 *
 * The `~/.opensquid` candidate is rooted at `OPENSQUID_HOME()` (not raw
 * `os.homedir()`) so the env-var override that the rest of `src/`
 * honors — tests point it at an `mkdtemp` for isolation — extends to
 * token resolution too. `~/.loop/.env` and `<cwd>/.env` stay anchored
 * to `homedir()` / `process.cwd()` respectively: those are not part of
 * the opensquid data root.
 *
 * Imports from: node:fs/promises, node:os, node:path, ../runtime/paths.
 * Imported by: src/channels config loader (config.ts).
 */
export type EnvKey = 'OPENSQUID_TELEGRAM_BOT_TOKEN' | 'OPENSQUID_DISCORD_BOT_TOKEN' | 'OPENSQUID_SLACK_BOT_TOKEN' | 'OPENSQUID_SLACK_APP_TOKEN';
export type EnvSource = 'env' | 'env-file' | 'config-json' | 'missing';
export interface TokenLookup {
    value: string | undefined;
    source: EnvSource;
    /** Path to the .env file used (only set when source === "env-file"). */
    env_file_path?: string;
}
/**
 * Resolve a token by priority: process.env → .env file → config.json
 * fallback (caller-supplied). Returns the value AND the source it
 * came from so the caller can log the source without exposing the
 * value.
 */
export declare function resolveToken(key: EnvKey, configJsonFallback: string | undefined): Promise<TokenLookup>;
/**
 * Find the first existing .env file in the search order. Returns null
 * if none exist.
 */
export declare function locateEnvFile(): Promise<string | null>;
/**
 * Parse a .env file into a flat string map. Supports:
 *
 *   - `KEY=VALUE` lines (standard dotenv format)
 *   - `KEY="quoted value"` (double-quoted)
 *   - `KEY='quoted value'` (single-quoted)
 *   - `#` comments + blank lines
 *   - Bare-token fallback: if the file has exactly ONE non-comment
 *     line and that line has no `=`, treat it as
 *     OPENSQUID_TELEGRAM_BOT_TOKEN (most common shape for "user
 *     saved just the token")
 *
 * Caches by path to avoid re-reading on every call.
 */
export declare function loadEnvFile(envPath: string): Promise<Record<string, string>>;
/** Test-only: clear the .env cache so subsequent loads re-read disk. */
export declare function _clearEnvFileCache(): void;
//# sourceMappingURL=env-token.d.ts.map