/**
 * The dev-mode model-credential resolver (install-dx v1, re-derived 2026-07-18).
 * Runtime model credentials are REAL KEYS ONLY — CLI-session rungs were removed
 * (a coding-agent login helps at init time only, never serves product turns).
 * Detection is PURE and read-only — no network, no writes, no key material in
 * the result (consumers read the env variable themselves).
 *
 * SELECTION LAW (2026-08-11): env keys are credentials, config selects. A
 * provider key lying around in the environment no longer selects a model —
 * `models: { default: … }` on createVendo does, and `VENDO_API_KEY` is the only
 * blessed default-filler for the slot a host left unset. Order:
 *
 *   1. VENDO_API_KEY (Vendo Cloud starter allowance / gateway)
 *   2. none (honest failure with exact instructions — NO_CREDENTIAL_MESSAGE)
 *
 * The `env-key` rung still EXISTS, and `ENV_KEY_VARS` is still its credential
 * table, but nothing arrives at it by accident: only the internal
 * `VENDO_DEV_CREDENTIAL` pin below can name it.
 */
export type EnvKeyProvider = "anthropic" | "openai" | "google";
export type DevCredential = {
    rung: "env-key";
    provider: EnvKeyProvider;
    envVar: string;
} | {
    rung: "vendo-cloud";
} | {
    rung: "none";
};
export declare const ENV_KEY_VARS: ReadonlyArray<{
    envVar: string;
    provider: EnvKeyProvider;
}>;
export interface ResolveDevCredentialOptions {
    env?: Record<string, string | undefined>;
}
/** Detect the best available model credential. `VENDO_DEV_CREDENTIAL`
 *  (env-key:anthropic | vendo-cloud | none) pins the rung explicitly.
 *  INTERNAL ONLY — it is Vendo's own E2E rung matrix and escape hatch, not a
 *  documented host knob, and since the selection law it is the ONLY way to reach
 *  the `env-key` rung at all. Async for seam stability (callers and test seams
 *  predate the session-rung removal). */
export declare function resolveDevCredential(options?: ResolveDevCredentialOptions): Promise<DevCredential>;
/** One human line for the wizard / doctor / runtime log. */
export declare function describeDevCredential(credential: DevCredential): string;
//# sourceMappingURL=resolve.d.ts.map