import type { ProviderAuthRouteDescriptor, ProviderRuntimeMetadataDeps } from './interface.js';
export interface StandardProviderAuthOptions {
    readonly providerId: string;
    readonly apiKeyEnvVars?: readonly string[] | undefined;
    readonly secretKeys?: readonly string[] | undefined;
    readonly serviceNames?: readonly string[] | undefined;
    readonly subscriptionProviderId?: string | undefined;
    readonly allowAnonymous?: boolean | undefined;
    readonly anonymousConfigured?: boolean | undefined;
    readonly anonymousDetail?: string | undefined;
}
/**
 * The conventional API-key env var for a provider that declared none:
 * uppercase, runs of non-alphanumerics to a single underscore, `_API_KEY`
 * suffix. `abacusai` derives `ABACUSAI_API_KEY`.
 */
export declare function deriveProviderApiKeyEnvVar(providerId: string): string;
/**
 * Fold the per-route truth into the aggregate `auth.configured` / `auth.detail`
 * pair a provider reports.
 *
 * The aggregate used to be computed from the provider's own local signal alone
 * (usually "is the API key env var set"), while the routes array right next to
 * it reported a usable subscription-oauth session. A caller reading only the
 * aggregate then saw `configured: false` with "OPENAI_API_KEY or OPENAI_KEY not
 * set" on a provider whose subscription route was healthy and serving turns.
 *
 * When the local signal says configured, it stands. Otherwise the first route
 * that is usable, or failing that the first route that is configured with a
 * real credential behind it (`freshness` not `'unconfigured'`, so a built-in
 * adapter with no stored session does not count), makes the aggregate
 * configured and the detail names that route instead of a missing env key.
 */
export declare function summarizeProviderAuth(base: {
    readonly configured: boolean;
    readonly detail: string;
}, routes: readonly ProviderAuthRouteDescriptor[]): {
    readonly configured: boolean;
    readonly detail: string;
};
export declare function buildStandardProviderAuthRoutes(options: StandardProviderAuthOptions, deps: ProviderRuntimeMetadataDeps): Promise<readonly ProviderAuthRouteDescriptor[]>;
//# sourceMappingURL=runtime-metadata.d.ts.map