/**
 * Secrets / settings store — barrel export. Phase 1 surface.
 */
export { REGISTRY, RECOMMENDED_MODELS, SYSTEM_ALLOWLIST, OPERATIONAL_ALLOWLIST, getKeyDef, getKeyDefByEnvAlias, getKeyConstraint, listWorkspaceSettingsSchema, getAllConsoleUrls, allRegisteredEnvAliases, } from './registry.js';
export { encrypt, decrypt, generateMasterKey } from './encryption.js';
export { loadMasterKey, loadPreviousMasterKey } from './master-key.js';
export { SqliteEncryptedStore } from './SqliteEncryptedStore.js';
export { AuditLogger } from './audit.js';
export { SettingsResolver } from './SettingsResolver.js';
export { tryResolve, tryResolveWithSource } from './read-flip.js';
let _store;
export function setSecretStore(store) {
    _store = store;
    // Drop the cached resolver so a freshly-installed store isn't shadowed.
    _resolver = undefined;
}
/**
 * Module-level accessor. Throws when the boot path didn't initialize the
 * store (test harness, early-init code paths). Hard error rather than
 * silent undefined to surface mis-wired callsites quickly.
 */
export function getSecretStore() {
    if (!_store) {
        throw new Error('Secrets store not initialized. The serve.ts bootstrap should have set this up — call site is running too early or in a test without store wiring.');
    }
    return _store;
}
export function hasSecretStore() {
    return _store !== undefined;
}
import { SettingsResolver } from './SettingsResolver.js';
const _mutationListeners = new Set();
export function onSecretMutation(fn) {
    _mutationListeners.add(fn);
    return () => { _mutationListeners.delete(fn); };
}
export function notifySecretMutation(key) {
    for (const fn of _mutationListeners) {
        try {
            fn(key);
        }
        catch {
            // Listener bugs must not break the caller's write.
        }
    }
}
/**
 * Lazily-instantiated process-wide SettingsResolver. Reads the same
 * singleton SqliteEncryptedStore that `setSecretStore()` registered. The
 * resolver is cheap (just a wrapper) — we cache it so callers don't
 * have to plumb a `SettingsResolver` instance through their call graph.
 *
 * Returns undefined when the new-store flag is off / boot didn't
 * initialize the store — call sites in Phase 6 use
 * `tryResolveFromStore()` which guards on this.
 */
let _resolver;
export function getSettingsResolver() {
    if (!_store)
        return undefined;
    if (!_resolver) {
        _resolver = new SettingsResolver({ secrets: _store, settings: _store });
    }
    return _resolver;
}
/**
 * Reset the cached resolver. Tests call this after swapping the store
 * out — without it the cached resolver retains the prior `_store`
 * reference and reads against a closed handle.
 */
export function _resetCachedResolver() {
    _resolver = undefined;
}
//# sourceMappingURL=index.js.map