import { d as Model } from "./types-CBQ0-JNc.js";
import { i as OpenClawConfig } from "./types.openclaw-Dkap9jPv.js";
import { Bs as requireApiKey, Ps as resolveApiKeyForProvider$1, Rs as ResolvedProviderAuth, Us as resolveEnvApiKey, Vs as resolveAwsSdkEnvVarName, ko as ResolvedProviderRuntimeAuth, vn as ProviderPreparedRuntimeAuth } from "./types-VTSyQW4p.js";
import { i as NON_ENV_SECRETREF_MARKER } from "./model-auth-markers-rG64hvLL.js";
import { n as TransientProviderRetryConfig } from "./operation-retry-x92MYk0c.js";

//#region src/plugins/runtime/runtime-model-auth.runtime.d.ts
/**
 * Resolve request-ready auth for a runtime model, applying any provider-owned
 * `prepareRuntimeAuth` exchange on top of the standard credential lookup.
 */
declare function getRuntimeAuthForModel$1(params: {
  model: Model;
  cfg?: OpenClawConfig;
  workspaceDir?: string;
}): Promise<ResolvedProviderRuntimeAuth>;
//#endregion
//#region src/agents/api-key-rotation.d.ts
type ApiKeyRetryParams = {
  apiKey: string;
  error: unknown;
  attempt: number;
};
type ExecuteWithApiKeyRotationOptions<T> = {
  provider: string;
  apiKeys: string[];
  execute: (apiKey: string) => Promise<T>;
  shouldRetry?: (params: ApiKeyRetryParams & {
    message: string;
  }) => boolean;
  onRetry?: (params: ApiKeyRetryParams & {
    message: string;
  }) => void;
  transientRetry?: TransientProviderRetryConfig;
};
declare function collectProviderApiKeysForExecution(params: {
  provider: string;
  primaryApiKey?: string;
}): string[];
declare function executeWithApiKeyRotation<T>(params: ExecuteWithApiKeyRotationOptions<T>): Promise<T>;
//#endregion
//#region src/plugin-sdk/provider-auth-runtime.d.ts
type OAuthCallbackResult = {
  code: string;
  state: string;
};
declare function buildOAuthCallbackOriginResolver(allowedHosts: readonly string[] | undefined): (originHeader: string | string[] | undefined) => string | undefined;
declare function generateOAuthState(): string;
declare function parseOAuthCallbackInput(input: string, messages?: {
  missingState?: string;
  invalidInput?: string;
}): OAuthCallbackResult | {
  error: string;
};
declare function waitForLocalOAuthCallback(params: {
  expectedState: string;
  timeoutMs: number;
  port: number;
  callbackPath: string;
  redirectUri: string;
  successTitle: string;
  progressMessage?: string;
  hostname?: string;
  onProgress?: (message: string) => void;
  corsOriginAllowlist?: readonly string[];
}): Promise<OAuthCallbackResult>;
type ResolveApiKeyForProvider = typeof resolveApiKeyForProvider$1;
type GetRuntimeAuthForModel = typeof getRuntimeAuthForModel$1;
declare function resolveApiKeyForProvider(params: Parameters<ResolveApiKeyForProvider>[0]): Promise<Awaited<ReturnType<ResolveApiKeyForProvider>>>;
declare function getRuntimeAuthForModel(params: Parameters<GetRuntimeAuthForModel>[0]): Promise<Awaited<ReturnType<GetRuntimeAuthForModel>>>;
//#endregion
export { NON_ENV_SECRETREF_MARKER, OAuthCallbackResult, type ProviderPreparedRuntimeAuth, type ResolvedProviderAuth, type ResolvedProviderRuntimeAuth, buildOAuthCallbackOriginResolver, collectProviderApiKeysForExecution, executeWithApiKeyRotation, generateOAuthState, getRuntimeAuthForModel, parseOAuthCallbackInput, requireApiKey, resolveApiKeyForProvider, resolveAwsSdkEnvVarName, resolveEnvApiKey, waitForLocalOAuthCallback };