/**
 * Hermes token resolution — canonical, side-effect-free implementation.
 *
 * This module exists for two reasons:
 *
 *   1. **Testability.** The `NousHermesRunner` defines these helpers as
 *      function-local closures (so call sites can capture `agentCustomEnv`,
 *      `TOKEN_KEYS`, `agentName`, `logger`, `tmpSettingsPath` from the
 *      enclosing scope without ceremony). That makes the logic untestable
 *      in isolation. This module is the canonical, parameterized version.
 *      Any divergence between the local closure and this module is a bug —
 *      keep them in sync.
 *
 *   2. **Audit surface.** When debugging "why did the runner pick
 *      `MINIMAX_API_KEY` over `ANTHROPIC_AUTH_TOKEN`?", you can import
 *      `resolveTokenWithDetection` from this module in a REPL or a one-off
 *      script and replay the decision without spinning up a Hermes run.
 *
 * Token detection convention (Hermes v0.16.0):
 *   MiniMax     → "sk-cp-..."  → env MINIMAX_API_KEY
 *   Z.AI / GLM  → "32hex.32hex"  → env ZAI_ANTHROPIC_FALLBACK_KEY
 *                 e.g. "c78a134949fc4c369911c24e9fa4b84c.OZhHX5Obs6qF1ISt"
 *   Z.AI alt    → 32-char hex (single block, no dot)
 *                 e.g. "5f650035e5a845549e4765184d8179b1"
 *   Anthropic   → "sk-ant-..." → env ANTHROPIC_AUTH_TOKEN
 *   OpenAI      → "sk-..."     → env OPENAI_API_KEY
 *   OpenRouter  → "sk-or-..."  → env OPENROUTER_API_KEY (BLOCKED for LLM)
 *   Mistral     → (variable)   → env MISTRAL_API_KEY_*
 *   Other       → unknown      → env ANTHROPIC_AUTH_TOKEN
 */
export interface ProviderDetection {
    provider: string;
    envKey: string;
}
export declare const TOKEN_PREFIX_PROVIDERS: ReadonlyArray<{
    test: (t: string) => boolean;
    provider: string;
    envKey: string;
}>;
export declare function detectTokenProvider(token: string): ProviderDetection;
export interface ResolvedToken {
    tokenEnvKey: string;
    tokenValue: string;
    detectedProvider: string;
    source: 'settings-explicit' | 'env-fallback' | 'detected';
}
export interface ResolverLogger {
    info: (obj: object, msg?: string) => void;
    error: (obj: object, msg?: string) => void;
}
/**
 * Resolve a token with explicit settings priority + provider detection.
 *
 * Strategy:
 *   1. Read settings_<agent>.json env block (explicitSettingsTokens).
 *      - Literal token (e.g. "sk-cp-...")  → use it directly.
 *      - $VAR reference (e.g. "$GLM_API_KEY_Y") → resolve against process.env.
 *        Missing? FAIL LOUD (no silent fallback).
 *   2. No settings token → iterate tokenKeys in priority order. THREE PASSES:
 *        Pass A: prefer a candidate whose env-var NAME already matches its
 *                detected provider (preserves explicit user choice over
 *                generic-key re-map).
 *        Pass B: re-map the first candidate to the right provider env-var
 *                name (subtilisation).
 *        Pass C: rare — everything aligned already, return as-is.
 *
 * @throws {Error} `MISSING_ENV_VAR: ...` when settings references a $VAR that
 *                 is not in process.env.
 */
export declare function resolveTokenWithDetection(agentName: string | undefined, explicitSettingsTokens: ReadonlyArray<{
    key: string;
    value: string;
}>, agentCustomEnv: Record<string, string | undefined>, tokenKeys: ReadonlyArray<string>, logger: ResolverLogger): ResolvedToken | null;
//# sourceMappingURL=hermesTokenResolver.d.ts.map