import { RuntimeDescriptor } from "./adapter.cjs";
//#region src/services/hosting/secrets.d.ts
declare const RESERVED_SECRET_NAMES: ReadonlySet<string>;
declare const RESERVED_SECRET_PREFIX = "BOS_";
declare const SECRET_NAME_PATTERN: RegExp;
declare function isReservedSecretName(name: string): boolean;
declare function isValidSecretName(name: string): boolean;
/** The runtime identity a descriptor carries in its `identityEnv`. */
declare function descriptorRuntime(descriptor: RuntimeDescriptor): {
  account?: string;
  gateway?: string;
};
/**
 * Merge resolved stored secrets into a descriptor's `identityEnv`. The
 * descriptor's own keys always win — stored values can never shadow the
 * platform-composed identity.
 */
declare function withSecrets(descriptor: RuntimeDescriptor, stored: Record<string, string>): RuntimeDescriptor;
//#endregion
export { RESERVED_SECRET_NAMES, RESERVED_SECRET_PREFIX, SECRET_NAME_PATTERN, descriptorRuntime, isReservedSecretName, isValidSecretName, withSecrets };
//# sourceMappingURL=secrets.d.cts.map