/**
 * kosha-discovery — Multi-source credential resolver.
 *
 * Implements a layered search strategy to locate API keys and
 * access tokens for each supported provider.  The search hierarchy is:
 *
 *   1. **Explicit config** — key passed directly via `KoshaConfig.providers`
 *   2. **Environment variables** — e.g. `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`
 *   3. **CLI tool credential files** — Claude CLI, Copilot, Codex, Gemini CLI
 *   4. **Config / OAuth files** — `~/.config/*`, gcloud ADC, `~/.aws/*`
 *   5. **CLI subprocess** — `gcloud auth print-access-token` etc.
 *
 * The resolver returns the **first** credential found and never throws.
 * If nothing is found, `{ source: "none" }` is returned.
 * @module
 */
import type { CredentialResult } from "../types.js";
/**
 * Multi-source credential resolver for AI providers.
 *
 * Resolution priority per provider:
 *   1. Explicit config key (passed programmatically)
 *   2. Environment variables
 *   3. CLI tool credential files (Claude CLI, Copilot, Gemini CLI, etc.)
 *   4. Config / OAuth files (~/.config/*)
 *
 * Always returns a {@link CredentialResult}; never throws.
 */
export declare class CredentialResolver {
    private readonly home;
    private readonly isWindows;
    /**
     * Return every plausible config-directory path for a per-tool config file,
     * in resolution order. We honour both common Linux conventions
     * (`$XDG_CONFIG_HOME/<tool>`, `~/.config/<tool>`) and the Windows
     * convention (`%APPDATA%\<tool>`), so a user with credentials in any
     * standard location is found rather than silently skipped.
     */
    private toolConfigCandidates;
    /** Read the first existing JSON file from a list of candidate paths. */
    private readFirstJson;
    /**
     * Resolve credentials for the given provider.
     *
     * @param providerId  - Provider slug (e.g. "anthropic", "openai").
     * @param explicitKey - Optional API key passed from user config; takes
     *                      highest precedence when provided.
     * @returns The first credential found, or `{ source: "none" }`.
     */
    resolve(providerId: string, explicitKey?: string): Promise<CredentialResult>;
    /**
     * Resolve a credential from the provider descriptor's `credentialEnvVars`.
     *
     * This is the default path, so adding a provider to `PROVIDER_CATALOG` is
     * enough for `kosha` to find its key. Before this existed, a catalog entry
     * with no matching `case` silently resolved to `{ source: "none" }` and the
     * provider looked unauthenticated no matter what the environment held.
     */
    private resolveFromCatalog;
    /**
     * Search hierarchy for Anthropic credentials:
     *   1. Explicit config key
     *   2. `ANTHROPIC_API_KEY` env var
     *   3. `~/.claude.json` (Claude CLI)
     *   4. `~/.config/claude/settings.json` (Claude CLI settings)
     *   5. `~/.claude/credentials.json` (Claude CLI OAuth)
     *   6. `~/.codex/auth.json` (Codex CLI — stores Anthropic keys)
     */
    private resolveAnthropic;
    /**
     * Search hierarchy for OpenAI credentials:
     *   1. Explicit config key
     *   2. `OPENAI_API_KEY` env var
     *   3. GitHub Copilot `hosts.json` (contains an OAuth token usable with OpenAI-compatible APIs)
     *   4. GitHub Copilot `apps.json` (alternative credential location)
     */
    private resolveOpenAI;
    /**
     * Search hierarchy for Google / Gemini credentials:
     *   1. Explicit config key
     *   2. `GOOGLE_API_KEY` or `GEMINI_API_KEY` env var
     *   3. Gemini CLI `~/.gemini/credentials.json`
     *   4. gcloud Application Default Credentials (ADC)
     */
    private resolveGoogle;
    /**
     * Search hierarchy for OpenRouter credentials:
     *   1. Explicit config key
     *   2. `OPENROUTER_API_KEY` env var
     *   (No known CLI tool stores OpenRouter keys on disk.)
     */
    private resolveOpenRouter;
    /**
     * Search hierarchy for Vercel AI Gateway credentials:
     *   1. Explicit config key
     *   2. `AI_GATEWAY_API_KEY` env var
     *   3. `VERCEL_OIDC_TOKEN` env var (available on Vercel deployments)
     */
    private resolveVercelAIGateway;
    /**
     * Ollama runs locally and never requires authentication.
     * Returns `{ source: "none" }` unconditionally.
     */
    private resolveOllama;
    /**
     * Search hierarchy for AWS Bedrock credentials:
     *   1. Explicit config key (`config.providers.bedrock.apiKey` or `config.providers.aws.apiKey`)
     *   2. `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` env vars (both must be present)
     *   3. `AWS_PROFILE` env var — signals a named profile in `~/.aws/credentials`
     *   4. `~/.aws/credentials` — reads the `[default]` profile's `aws_access_key_id`
     *   5. `~/.aws/config` — detects SSO or IAM role configuration (presence check only)
     *
     * The returned `metadata.region` is resolved from (in order):
     *   `AWS_DEFAULT_REGION` → `AWS_REGION` → `region` in `~/.aws/config [default]` → `"us-east-1"`
     *
     * @param explicitKey - Optional AWS access key ID passed from user config.
     * @returns Resolved credential with `key` (access key ID or sentinel) and `metadata.region`.
     */
    private resolveBedrockCredential;
    /**
     * Resolve the effective AWS region from environment variables or the
     * parsed `~/.aws/config` content.
     *
     * Priority: `AWS_DEFAULT_REGION` → `AWS_REGION` → `region` in `[default]`
     * profile of the provided config text → `"us-east-1"` fallback.
     *
     * @param awsConfigRaw - Optional raw text of `~/.aws/config` already read by the caller.
     * @returns The resolved region string.
     */
    private resolveAwsRegion;
    /**
     * Parse a single named section from an AWS INI-format file.
     *
     * AWS credential/config files use INI syntax with `[section]` headers and
     * `key = value` pairs. This parser is intentionally minimal: it only extracts
     * key-value pairs belonging to the requested section and ignores all others.
     *
     * @param text        - Raw file content.
     * @param sectionName - Section header to extract (without brackets), e.g. `"default"`.
     * @returns A map of key → value strings found within the section, or `{}` if not found.
     */
    private parseAwsIniSection;
    /**
     * Search hierarchy for GCP Vertex AI credentials:
     *   1. Explicit config key (`config.providers.vertex.apiKey`)
     *   2. `GOOGLE_APPLICATION_CREDENTIALS` env var — path to service account JSON
     *   3. `~/.config/gcloud/application_default_credentials.json` (gcloud ADC)
     *   4. `gcloud auth print-access-token` subprocess (5 s timeout)
     *
     * The returned `metadata` always contains `region` and optionally `projectId`
     * resolved from (in order):
     *   - `GOOGLE_CLOUD_PROJECT` / `GCLOUD_PROJECT` env vars
     *   - `gcloud config get-value project` subprocess
     *
     * @param explicitKey - Optional explicit key or service-account path from user config.
     * @returns Resolved credential with `key` and `metadata.{ projectId?, region }`.
     */
    private resolveVertexCredential;
    /**
     * Resolve Vertex AI metadata: GCP project ID and region.
     *
     * Project ID priority: `GOOGLE_CLOUD_PROJECT` → `GCLOUD_PROJECT` → `gcloud config get-value project`
     * Region priority:     `GOOGLE_CLOUD_REGION` → `"us-central1"`
     *
     * @returns Metadata object with `region` (always set) and optional `projectId`.
     */
    private resolveVertexMetadata;
    /**
     * Run `gcloud auth print-access-token` and return the trimmed token.
     * Returns `null` on any error (gcloud not installed, not authenticated, timeout, etc.).
     */
    private execGcloudToken;
    /**
     * Run `gcloud config get-value project` and return the trimmed project ID.
     * Returns `null` on any error.
     */
    private execGcloudProject;
    /**
     * Generic resolver for providers that only need an explicit key or a single env var.
     * Used by NVIDIA, Together AI, Fireworks AI, Groq, and Mistral AI.
     */
    private resolveNvidia;
    private resolveSimpleEnvKey;
    private resolveMultiEnvKey;
    /** Safely read and parse a JSON file; returns null on any error. */
    private readJson;
    /** Safely read a text file as a string; returns null on any error. */
    private readTextFile;
    /** Return candidate paths for GitHub Copilot config files. */
    private getCopilotPaths;
    /** Return candidate paths for gcloud ADC. */
    private getGcloudPaths;
    /** Extract the first OAuth token from a Copilot hosts/apps JSON structure. */
    private extractCopilotToken;
}
//# sourceMappingURL=resolver.d.ts.map