/**
 * Secrets API routes — Phase 7 of the secrets refactor.
 *
 * Write-only-from-the-outside contract for secret-classified registry
 * keys. The value never leaves the server via these endpoints: GET
 * returns metadata only (label, provider, last_tested_at, …), and the
 * test-connection probe runs server-side without echoing the value.
 *
 *   GET    /api/secrets                       — list metadata
 *   PUT    /api/secrets/:key                  — set or overwrite (audited)
 *   DELETE /api/secrets/:key                  — delete (audited)
 *   POST   /api/secrets/:key/test             — dispatch registry probe
 *
 * Owner-only. Bootstrap-classified keys (jwt.secret, master.key, …)
 * reject with 400 — those live in env-vars only and are not store-
 * settable. User-secret keys also reject — those live in auth.db per
 * Phase 8.
 *
 * The test endpoint dispatches `def.testConnection(value)` from the
 * registry. The returned shape is `{ ok: bool, message?: string }` —
 * server-derived, no upstream error body echoed. Tests are audited
 * (success + duration), no upstream message in the audit row either.
 *
 * After the scope-collapse refactor, requests carry no `scope` /
 * `scope_id` — Studiograph is single-workspace-per-process. Any legacy
 * `scope` query param or body field is silently ignored.
 */
import type { FastifyInstance } from 'fastify';
import { type AuthService } from '../../services/auth-service.js';
/**
 * Test-only hook: clear the process-wide cache. Vitest setups that swap
 * the store between cases need to call this so a prior test's result
 * doesn't leak into the next. Underscored to mark it as non-public.
 */
export declare function _resetSecretsTestCache(): void;
export declare function registerSecretsApiRoutes(fastify: FastifyInstance, authService: AuthService): Promise<void>;
