/**
 * Secrets / settings store — barrel export. Phase 1 surface.
 */
export { REGISTRY, RECOMMENDED_MODELS, SYSTEM_ALLOWLIST, OPERATIONAL_ALLOWLIST, getKeyDef, getKeyDefByEnvAlias, getKeyConstraint, listWorkspaceSettingsSchema, getAllConsoleUrls, allRegisteredEnvAliases, } from './registry.js';
export type { Classification, RedactionMode, KeyDef, KeyConstraint, SettingSchemaEntry, SettingRecommendations, } from './registry.js';
export { encrypt, decrypt, generateMasterKey } from './encryption.js';
export type { AADInput, EncryptedRow } from './encryption.js';
export { loadMasterKey, loadPreviousMasterKey } from './master-key.js';
export type { LoadedMasterKey } from './master-key.js';
export { SqliteEncryptedStore } from './SqliteEncryptedStore.js';
export type { SqliteEncryptedStoreOptions } from './SqliteEncryptedStore.js';
export { AuditLogger } from './audit.js';
export type { AuditAction, AuditEvent } from './audit.js';
export { SettingsResolver } from './SettingsResolver.js';
export type { ResolutionSource, ResolvedValue, ResolverContext, ResolverDeps, } from './SettingsResolver.js';
export { tryResolve, tryResolveWithSource } from './read-flip.js';
export type { ActorContext, SecretMetadata, SecretStore, SetSecretInput, } from './SecretStore.js';
export type { SettingMetadata, SettingsStore, SetSettingInput, } from './SettingsStore.js';
import type { SqliteEncryptedStore as SqliteEncryptedStoreType } from './SqliteEncryptedStore.js';
export declare function setSecretStore(store: SqliteEncryptedStoreType | undefined): void;
/**
 * Module-level accessor. Throws when the boot path didn't initialize the
 * store (test harness, early-init code paths). Hard error rather than
 * silent undefined to surface mis-wired callsites quickly.
 */
export declare function getSecretStore(): SqliteEncryptedStoreType;
export declare function hasSecretStore(): boolean;
import { SettingsResolver } from './SettingsResolver.js';
/**
 * Mutation notification — fires after any successful set/delete on the
 * store. Consumers subscribe here so they can react to store changes
 * without polling. Primary use case: the agent pool cache eviction
 * when a model.* key changes (otherwise running agents keep using the
 * apiKey they captured at construction time).
 *
 * Listener errors are swallowed — never let a stray listener take down
 * a write path. Listeners must not be slow (we run them synchronously
 * on the write request's hot path).
 */
type SecretMutationListener = (key: string) => void;
export declare function onSecretMutation(fn: SecretMutationListener): () => void;
export declare function notifySecretMutation(key: string): void;
export declare function getSettingsResolver(): SettingsResolver | undefined;
/**
 * Reset the cached resolver. Tests call this after swapping the store
 * out — without it the cached resolver retains the prior `_store`
 * reference and reads against a closed handle.
 */
export declare function _resetCachedResolver(): void;
