/**
 * Provider auth env candidates used by generic auth resolution.
 *
 * Order matters: the first non-empty value wins for helpers such as
 * `resolveEnvApiKey()`. Bundled providers source this from plugin manifest
 * metadata so auth probes do not need to load plugin runtime.
 */
export declare const PROVIDER_AUTH_ENV_VAR_CANDIDATES: Record<string, readonly string[]>;
/**
 * Provider env vars used for setup/default secret refs and broad secret
 * scrubbing. This can include non-model providers and may intentionally choose
 * a different preferred first env var than auth resolution.
 *
 * Bundled provider auth envs come from plugin manifests. The override map here
 * is only for true core/non-plugin providers and a few setup-specific ordering
 * overrides where generic onboarding wants a different preferred env var.
 */
export declare const PROVIDER_ENV_VARS: Record<string, readonly string[]>;
export declare function getProviderEnvVars(providerId: string): string[];
export declare function listKnownProviderAuthEnvVarNames(): string[];
export declare function listKnownSecretEnvVarNames(): string[];
export declare function omitEnvKeysCaseInsensitive(baseEnv: NodeJS.ProcessEnv, keys: Iterable<string>): NodeJS.ProcessEnv;