/**
 * Keys another Settings surface creates and rotates. API keys lists them
 * read-only, and the secrets delete routes refuse them unless the owner
 * surface itself asks (see `isManagedDeleteAllowed`).
 */
import { type SecretManagedBy, type SecretUsage } from "./register.js";
export declare const SECRET_MANAGERS: {
    readonly builder: {
        readonly id: "builder";
        readonly owner: "Builder.io";
        readonly route: "integrations/builder";
    };
    readonly storage: {
        readonly id: "storage";
        readonly owner: "File uploads and storage";
        readonly route: "infra";
    };
    readonly channels: {
        readonly id: "channels";
        readonly owner: "Channels";
        readonly route: "channels";
    };
    readonly meetings: {
        readonly id: "meetings";
        readonly owner: "Meetings";
        readonly route: "app/meetings";
    };
    readonly integrations: {
        readonly id: "integrations";
        readonly owner: "Integrations";
        readonly route: "integrations";
    };
    readonly automations: {
        readonly id: "automations";
        readonly owner: "Automations";
        readonly route: "automations";
    };
};
export type SecretManagerId = keyof typeof SECRET_MANAGERS;
/** The S3-compatible storage fields the storage form reads and writes. */
export declare const S3_STORAGE_SECRET_KEYS: readonly ["S3_ENDPOINT", "S3_BUCKET", "S3_ACCESS_KEY_ID", "S3_SECRET_ACCESS_KEY", "S3_REGION", "S3_PUBLIC_BASE_URL"];
/**
 * Who owns a key, if anyone other than API keys does. A registered secret is
 * managed only when its registration says so: registering a key is how an app
 * puts it on API keys, and the map below covers keys written by owner flows.
 */
export declare function resolveSecretManagedBy(key: string): SecretManagedBy | undefined;
/** Uses implied by a managed key's owner, for keys with no registration. */
export declare function managedSecretUsage(key: string): SecretUsage[];
/**
 * An owner surface deletes its own keys by naming itself (`managedBy=<id>`).
 * This is not an authorization check: scope and role checks still apply. It
 * keeps a managed key from being removed from API keys, where removing it
 * would leave its owner half-configured.
 */
export declare function isManagedDeleteAllowed(managedBy: SecretManagedBy, requestedBy: string | null | undefined): boolean;
export declare function managedDeleteRefusal(key: string, managedBy: SecretManagedBy): {
    error: string;
    errorCode: "secret_managed_elsewhere";
    managedBy: SecretManagedBy;
};