import type { Config } from '../types/index.js';
import type { LlmProviderType } from '../types/config.schema.js';
export interface ProviderCredentialOptions {
    /** --provider-key: the credential (ephemeral). */
    providerKey?: string;
    /** --provider: the provider type (claude | openai | openrouter). */
    provider?: string;
}
export interface ResolvedProviderCredentials {
    /** The resolved provider type (defaults to 'claude'). */
    providerType: LlmProviderType;
    /** The resolved credential. Empty string when none was supplied. */
    authToken: string;
    /** Human-readable error strings. Empty when the credential is valid. */
    errors: string[];
    /**
     * True only when no token was supplied at all (via flag, config, or env) —
     * NOT for the wrong-format case. Lets interactive callers (e.g. `hula launch`)
     * distinguish "prompt the user for a key" from other errors. Purely additive:
     * `errors` behavior is unchanged, so non-interactive callers such as `hula
     * schedule` are unaffected.
     */
    missingToken: boolean;
}
/**
 * Per-provider token format validation. Returns an error string when the token
 * does not match the provider's expected format, or `null` when it is
 * acceptable. `claude` and `openrouter` enforce a prefix (which catches
 * cross-provider paste mistakes before any network call); `openai` only
 * requires a non-empty string (formats vary — live validation catches bad keys).
 */
export declare function validateTokenFormat(providerType: LlmProviderType, authToken: string): string | null;
/**
 * Resolve the ephemeral LLM provider credential required to launch a hula-server
 * sandbox, via a single precedence chain shared by every command that POSTs to
 * the sandbox APIs.
 *
 * Provider type (highest precedence first):
 *   1. explicit CLI flag (--provider)
 *   2. .hublaunch/hublaunch.config.js (config.provider.type)
 *   3. default 'claude'
 *
 * Credential (highest precedence first):
 *   1. explicit CLI flag (--provider-key)
 *   2. .hublaunch/hublaunch.config.js (config.provider.apiKey)
 *   3. environment variable (PROVIDER_AUTH_TOKEN)
 *
 * Pure and side-effect free: returns the resolved values plus a list of
 * human-readable error strings. Callers choose how to present errors (logger,
 * chalk) and whether to exit. This keeps resolution + validation in ONE place
 * (DRY) while leaving presentation to each command. Never echoes secret values.
 */
export declare function resolveProviderCredentials(options: ProviderCredentialOptions, config: Config): ResolvedProviderCredentials;
//# sourceMappingURL=provider-credentials.d.ts.map