export type SecretScope = "user" | "workspace" | "org";
export type SecretKind = "api-key" | "oauth";
export interface ValidatorResult {
    ok: boolean;
    error?: string;
    validationCode?: string;
    /** The check could not run (provider outage, rate limit); the value may be fine. */
    retryable?: boolean;
}
export interface SecretValidator {
    (value: string): Promise<ValidatorResult | boolean> | ValidatorResult | boolean;
}
/**
 * One thing a secret powers, shown as "Used by {feature}" and in the
 * remove-impact list. Copy is English, like `label` and `description`.
 */
export interface SecretUsage {
    /** Workspace app id that uses the key. Omit when every app uses it. */
    appId?: string;
    /** What uses the key, e.g. "Image generation". */
    feature: string;
    /** What happens when the key is removed, e.g. "Stops until another provider is set up." */
    effectWhenRemoved: string;
}
/**
 * The Settings surface that creates and rotates a key. Managed keys are
 * listed read-only on API keys and can only be removed from their owner.
 */
export interface SecretManagedBy {
    /** Stable owner id; an owner surface passes it back to delete its own keys. */
    id: string;
    /** Owner name shown in "Used by {owner}". */
    owner: string;
    /**
     * Settings page path (`page` or `page/sub`, e.g. "integrations/builder").
     * Resolve it through the settings route helper; it is not a URL.
     */
    route: string;
}
export interface RegisteredSecret {
    key: string;
    label: string;
    description?: string;
    docsUrl?: string;
    scope: SecretScope;
    kind: SecretKind;
    required?: boolean;
    validator?: SecretValidator;
    oauthProvider?: string;
    oauthConnectUrl?: string;
    /** What this app uses the key for. Framework uses merge in at read time. */
    usedFor?: SecretUsage[];
    /** Set when another Settings surface owns the key's lifecycle. */
    managedBy?: SecretManagedBy;
}
/**
 * Record uses of a key that hold whichever registration wins, e.g. framework
 * services on a provider key a template also registers.
 */
export declare function registerSecretUsage(key: string, usage: SecretUsage[]): void;
/** Registered uses of a key: its registration's `usedFor`, then extra uses. */
export declare function getRegisteredSecretUsage(key: string): SecretUsage[];
export declare function registerRequiredSecret(secret: RegisteredSecret): void;
export declare function listRequiredSecrets(): RegisteredSecret[];
export declare function getRequiredSecret(key: string): RegisteredSecret | undefined;
export declare function __resetSecretsRegistry(): void;