/**
 * Secrets router — backs the right pane's Secrets tab.
 *
 * Two stores, one list. A credential the user typed before their agent existed
 * in the cloud lives locally (core/pending-secrets.ts); one that has reached
 * Sapiom lives in the vault and is listable by NAME only
 * (core/vault-secrets.ts). This router folds them into a single view whose rows
 * carry which of the two they are, because "have I actually shipped this key"
 * is the question the tab exists to answer.
 *
 * NO VALUE LEAVES THIS PROCESS. The API key is held server-side (the same
 * reason account.ts and templates.ts read on the page's behalf), and the only
 * secret material in any response is absent: `GET` returns names and states.
 * A value travels in exactly one direction, browser → here → vault.
 *
 * WHY THE ID IS A PATH. Every other workflow-scoped route addresses an agent by
 * its absolute project directory (`/api/workflows/:id/deploy`), because that is
 * what the SPA holds and what the local store is keyed by. The cloud definition
 * id is read from the project's `sapiom.json` at request time rather than taken
 * from the caller — a client-supplied definition id would let one agent's tab
 * write into another agent's namespace.
 */
import { Router } from "express";
import { readConfig as coreReadConfig } from "@sapiom/agent-core";
import { type ApiKeyProvider } from "../core/api-key-provider.js";
import type { PendingSecretsStore } from "../core/pending-secrets.js";
import { type VaultSecretsClient } from "../core/vault-secrets.js";
export interface SecretsRouterOpts {
    /** The Sapiom API key (`sk_…`), NOT the local boot token. A provider lets a
     *  rejected key refresh + retry instead of locking the tab. */
    apiKey: string | null | ApiKeyProvider;
    /** Values authored before the agent was linked. */
    pendingSecrets: PendingSecretsStore;
    /** Resolve a registered agent's project directory from the route id. Mirrors
     *  the actions router's seam so this router never reads the registry. */
    resolveWorkflow: (id: string) => {
        path: string;
    } | null;
    /** Override the core base URL (resolved from env by default). Test seam. */
    baseUrl?: string;
    /** Injectable fetch. Test seam. */
    fetchImpl?: typeof fetch;
    /** Injectable vault client. Test seam; defaults to the real one. */
    vault?: VaultSecretsClient;
    /** Injectable `sapiom.json` read. Test seam. */
    readConfig?: typeof coreReadConfig;
}
export declare function createSecretsRouter(opts: SecretsRouterOpts): Router;
//# sourceMappingURL=secrets.d.ts.map