/**
 * Framework-level secret registrations.
 *
 * Side-effect module — imported by the core-routes plugin at boot so the
 * sidebar settings UI and the `/_agent-native/secrets` list route surface the
 * relevant keys in every template.
 *
 * Each call uses a `getRequiredSecret` guard so a template that has already
 * registered the same key (often with stricter settings like `required: true`)
 * wins — the framework registration is a fallback, not an override.
 *
 * OPENAI_API_KEY is optional framework-wide because it enables the shared
 * realtime speech-to-speech agent mode. Templates can pre-register the same
 * key with stricter requirements; the guard below preserves their definition.
 */
import { type ValidatorResult } from "./register.js";
/**
 * Reads a provider's answer to a key check. Only an authentication refusal
 * means the key is wrong; a rate limit or provider outage says nothing about
 * the key, so it is a retryable "could not verify" instead of a rejection.
 */
export declare function providerKeyCheckResult(provider: string, response: Response, options?: {
    acceptForbidden?: (body: string) => boolean;
}): Promise<ValidatorResult>;
export declare function registerFrameworkSecrets(): void;