import type { ProviderRuntimeResolvedAuthContract, ProviderRuntimeVaultErrorType } from "./provider-runtime-contract.js";
export declare const PROVIDER_RUNTIME_OPENAI_CODEX_PROVIDER_ID = "openai-codex";
export declare function normalizeProviderRuntimeId(provider: string): string;
export declare function normalizeProviderRuntimeIdForAuth(provider: string): string;
export declare const resolveProviderRuntimeKeyFamily: typeof normalizeProviderRuntimeIdForAuth;
export type ProviderRuntimeCapabilities = {
    anthropicToolSchemaMode: "native" | "openai-functions";
    anthropicToolChoiceMode: "native" | "openai-string-modes";
    providerFamily: "default" | "openai" | "anthropic";
    preserveAnthropicThinkingSignatures: boolean;
    openAiCompatTurnValidation: boolean;
    providerThoughtSignatureSanitization: boolean;
    transcriptToolCallIdMode: "default" | "strict9";
    transcriptToolCallIdModelHints: string[];
    providerThoughtSignatureModelHints: string[];
    dropThinkingBlockModelHints: string[];
};
export declare function resolveProviderRuntimeCapabilities(provider?: string | null): ProviderRuntimeCapabilities;
export declare function preservesProviderRuntimeAnthropicThinkingSignatures(provider?: string | null): boolean;
export declare function requiresOpenAiCompatibleAnthropicToolPayloadForProviderRuntime(provider?: string | null): boolean;
export declare function usesOpenAiFunctionAnthropicToolSchemaForProviderRuntime(provider?: string | null): boolean;
export declare function usesOpenAiStringModeAnthropicToolChoiceForProviderRuntime(provider?: string | null): boolean;
export declare function supportsOpenAiCompatTurnValidationForProviderRuntime(provider?: string | null): boolean;
export declare function isOpenAiProviderRuntimeFamily(provider?: string | null): boolean;
export declare function isAnthropicProviderRuntimeFamily(provider?: string | null): boolean;
export declare function shouldDropThinkingBlocksForProviderRuntimeModel(params: {
    provider?: string | null;
    modelId?: string | null;
}): boolean;
export declare function shouldSanitizeProviderRuntimeThoughtSignaturesForModel(params: {
    provider?: string | null;
    modelId?: string | null;
}): boolean;
export declare function resolveProviderRuntimeTranscriptToolCallIdMode(provider?: string | null, modelId?: string | null): "strict9" | undefined;
export type ProviderRuntimeCredentialRecord = {
    type: "api_key";
    key: string;
} | {
    type: string;
    access: string;
};
export type ProviderRuntimeCredentialMap = Record<string, ProviderRuntimeCredentialRecord>;
type InMemoryAuthStorageBackendLike = {
    withLock<T>(update: (current: string) => {
        result: T;
        next?: string;
    }): T;
};
export declare function createProviderRuntimeInMemoryAuthStorageBackend(initialData: ProviderRuntimeCredentialMap): InMemoryAuthStorageBackendLike;
export declare function createProviderRuntimeAuthStorage<TAuthStorage>(params: {
    AuthStorageLike: unknown;
    authPath: string;
    credentials: ProviderRuntimeCredentialMap;
    createBackend?: () => InMemoryAuthStorageBackendLike;
}): TAuthStorage;
export type ProviderRuntimeEnvApiKeyResult = {
    apiKey: string;
    source: string;
};
export type ProviderRuntimeResolvedAuthMode = "api-key" | "oauth" | "token" | "mixed" | "aws-sdk" | "unknown";
export type ProviderRuntimeResolvedAuth = ProviderRuntimeResolvedAuthContract & {
    apiKey?: string;
    profileId?: string;
    source: string;
    mode: "api-key" | "oauth" | "token" | "aws-sdk";
    vaultRelease?: () => void;
    vaultReportSuccess?: () => void;
    vaultReportError?: (errorType?: ProviderRuntimeVaultErrorType) => void;
};
export type ProviderRuntimePlatformKey = {
    key: string;
    source: string;
    release?: () => void;
    reportSuccess?: () => void;
    reportError?: (errorType?: ProviderRuntimeVaultErrorType) => void;
};
export declare function resolveProviderRuntimeAwsSdkEnvVarName(env?: NodeJS.ProcessEnv): string | undefined;
export declare function resolveProviderRuntimeAwsSdkAuthInfo(params?: {
    env?: NodeJS.ProcessEnv;
    appliedEnvKeys?: Iterable<string>;
}): {
    mode: "aws-sdk";
    source: string;
};
export declare const PROVIDER_RUNTIME_ENV_API_KEY_CANDIDATES: Record<string, readonly string[]>;
export declare function listProviderRuntimeEnvApiKeyNames(): string[];
export declare function resolveProviderRuntimeEnvApiKey(params: {
    provider: string;
    env?: NodeJS.ProcessEnv;
    appliedEnvKeys?: Iterable<string>;
    resolveSpecialApiKey?: (normalizedProvider: string, env: NodeJS.ProcessEnv, appliedEnvKeys: Set<string>) => ProviderRuntimeEnvApiKeyResult | null | undefined;
}): ProviderRuntimeEnvApiKeyResult | null;
export interface ProviderRuntimeAuthProfileDeps<TConfig, TStore> {
    ensureAuthProfileStore: (agentDir?: string) => TStore;
    listProfilesForProvider: (store: TStore, provider: string) => string[];
    resolveAuthProfileOrder: (params: {
        cfg?: TConfig;
        store: TStore;
        provider: string;
        preferredProfile?: string;
    }) => string[];
    resolveApiKeyForProfile: (params: {
        cfg?: TConfig;
        store: TStore;
        profileId: string;
        agentDir?: string;
    }) => Promise<{
        apiKey: string;
    } | null | undefined>;
    getProfileType: (store: TStore, profileId: string) => string | undefined;
}
export interface ProviderRuntimeAuthCoreDeps<TConfig, TStore, TModel> {
    isHubManagedProviderPathActive: () => boolean;
    profileDeps: ProviderRuntimeAuthProfileDeps<TConfig, TStore>;
    getCustomProviderApiKey: (cfg: TConfig | undefined, provider: string) => string | undefined;
    resolveProviderAuthOverride: (cfg: TConfig | undefined, provider: string) => Extract<ProviderRuntimeResolvedAuthMode, "api-key" | "oauth" | "token" | "aws-sdk"> | undefined;
    resolveEnvApiKey: (provider: string) => ProviderRuntimeEnvApiKeyResult | null | undefined;
    normalizeProviderId?: (provider: string) => string;
    resolveKeyFamily?: (provider: string) => string;
    getAppliedShellEnvKeys?: () => Iterable<string>;
    getFallbackProviders?: (provider: string) => string[];
    tryGetPlatformKey?: (provider: string) => ProviderRuntimePlatformKey | null | undefined;
    onPlatformKeyError?: (provider: string, error: unknown) => void;
    getModelProvider?: (model: TModel) => string;
    normalizeSecretInput?: (value: string | undefined) => string | undefined;
}
export declare function createProviderRuntimeAuthCore<TConfig, TStore, TModel>(deps: ProviderRuntimeAuthCoreDeps<TConfig, TStore, TModel>): {
    getApiKeyForModel: (params: {
        model: TModel;
        cfg?: TConfig;
        profileId?: string;
        preferredProfile?: string;
        store?: TStore;
        agentDir?: string;
    }) => Promise<ProviderRuntimeResolvedAuth>;
    requireApiKey: (auth: ProviderRuntimeResolvedAuth, provider: string) => string;
    resolveApiKeyForProvider: (params: {
        provider: string;
        cfg?: TConfig;
        profileId?: string;
        preferredProfile?: string;
        store?: TStore;
        agentDir?: string;
    }) => Promise<ProviderRuntimeResolvedAuth>;
    resolveModelAuthMode: (provider?: string, cfg?: TConfig, store?: TStore) => ProviderRuntimeResolvedAuthMode | undefined;
};
export {};
