/**
 * H3 event handlers for the framework secrets registry.
 *
 * Mounted under `/_agent-native/secrets/*` by `core-routes-plugin`.
 *
 * NEVER return a secret's plain-text value from any of these handlers.
 */
import { type SecretManagedBy, type SecretScope, type SecretUsage } from "./register.js";
export type SecretSource = "personal" | "workspace" | "vault";
export declare const SECRET_REJECTED_ERROR_CODE = "secret_rejected";
export declare const SECRET_VALIDATION_UNAVAILABLE_ERROR_CODE = "secret_validation_unavailable";
export interface SecretStatusPayload {
    key: string;
    label: string;
    description?: string;
    docsUrl?: string;
    scope: SecretScope;
    kind: "api-key" | "oauth";
    required: boolean;
    /**
     * "set" = value present; "unset" = not configured; "invalid" = the
     * provider rejected the value in effect (see `rejectedAt`); "unknown" = the
     * credential store could not be read.
     */
    status: "set" | "unset" | "invalid" | "unknown";
    /**
     * When the provider last rejected the value in effect (ms). Stays until a
     * call with it succeeds or the value is replaced. Metadata such as `last4`
     * is still reported so the row can offer Replace.
     */
    rejectedAt?: number;
    effectiveScope?: SecretScope;
    /** Where the effective value comes from — only when status is "set" or "invalid". */
    source?: SecretSource;
    managedHere?: boolean;
    overrides?: Exclude<SecretSource, "personal">;
    overriddenScope?: Exclude<SecretScope, "user">;
    /** Last 4 chars — for api-key kind when status is "set" or "invalid". */
    last4?: string;
    /** Timestamp (ms) of the last write — when status is "set" or "invalid". */
    updatedAt?: number;
    oauthProvider?: string;
    oauthConnectUrl?: string;
    error?: string;
    /** What uses the key, per app and feature. Empty when nothing is known to. */
    usedFor: SecretUsage[];
    /** Present when another Settings surface owns this key. */
    managedBy?: SecretManagedBy;
}
export declare function createListSecretsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<SecretStatusPayload[] | {
    error: string;
}>>;
export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
    error: string;
    errorCode: "secret_managed_elsewhere";
    managedBy: SecretManagedBy;
} | {
    ok?: undefined;
    error: string;
    errorCode?: undefined;
    status?: undefined;
} | {
    ok?: undefined;
    error: string;
    errorCode: string;
    status?: undefined;
} | {
    error?: undefined;
    errorCode?: undefined;
    ok: boolean;
    status: string;
} | {
    ok?: undefined;
    error: string;
    removed?: undefined;
} | {
    error?: undefined;
    ok: boolean;
    removed: boolean;
}>>;
export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
    ok?: undefined;
    error: string;
    note?: undefined;
} | {
    error?: undefined;
    ok: boolean;
    note?: undefined;
} | {
    error?: undefined;
    ok: boolean;
    note: string;
} | {
    note?: undefined;
    ok: boolean;
    error: string;
}>>;
export interface AdHocSecretPayload {
    name: string;
    scope: SecretScope;
    scopeId: string;
    source: Exclude<SecretSource, "env">;
    description: string | null;
    last4: string;
    urlAllowlist: string[] | null;
    createdAt: number;
    updatedAt: number;
    /** What uses the key. Empty when nothing is known to. */
    usedFor: SecretUsage[];
    /** Present when another Settings surface owns this key. */
    managedBy?: SecretManagedBy;
}
export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
    error: string;
    errorCode: "secret_managed_elsewhere";
    managedBy: SecretManagedBy;
} | {
    error: string;
} | {
    error?: undefined;
    ok: boolean;
    key: string;
} | {
    error?: undefined;
    ok: boolean;
    removed: boolean;
}>>;