/**
 * Settings API routes — Phase 7 of the secrets refactor.
 *
 * Exposes the non-secret half of the encrypted store: registry-classified
 * `*-setting` keys (model.id, model.provider, r2.bucket, search.google.cx,
 * etc.). Secret keys are NOT served here — they live behind `/api/secrets`,
 * which never returns plaintext values.
 *
 * Owner-only via the existing `isWorkspaceOwner()` helper. Matches the
 * authorization matrix in plan §3: workspace settings are
 * workspace-owner-only; members get 403.
 *
 * The routes register unconditionally now that Phase 6 has shipped.
 * Historically they were gated on `STUDIOGRAPH_NEW_STORE === '1'`; that
 * flag was removed once the encrypted store became the unconditional
 * source of truth. Handlers still return 503 if the store singleton
 * isn't initialized for some reason (test harness, early boot).
 *
 * Every mutation goes through the underlying SettingsStore, which audits
 * `set`/`delete` automatically. Audit reads land via the `/api/audit`
 * endpoint in audit-api.ts.
 *
 * After the scope-collapse refactor, requests carry no `scope` /
 * `scope_id` — Studiograph is single-workspace-per-process. Any legacy
 * `scope` query param or body field is silently ignored.
 */
import type { FastifyInstance } from 'fastify';
import { type AuthService } from '../../services/auth-service.js';
export declare function registerSettingsApiRoutes(fastify: FastifyInstance, authService: AuthService): Promise<void>;
