/**
 * First-run importer — Phase 6 of the secrets refactor.
 *
 * Walks the Key Registry and seeds the encrypted store from whatever
 * plaintext legacy files exist on disk:
 *
 *   ~/.studiograph/user.json                — workspace settings & secrets
 *   ~/.studiograph/auth.json                — GitHub PAT (bootstrap class, skipped)
 *   ~/.studiograph/connectors/*.json        — connector secrets
 *   <workspace>/.studiograph/workspace.json — workspace + r2 fields
 *
 * Plus the running process environment for any registry entry whose
 * `envAliases` matches a set `process.env.*`. Env values are mirrored
 * into the store but NEVER overwrite an existing row — they remain the
 * runtime source of truth via the resolver's precedence chain. The
 * import is purely a "warm the store" pass so the read-flip doesn't
 * see empty slots on first boot.
 *
 * Idempotency: a `meta.imported_legacy_at` row gates the whole pass.
 * Once set, the importer is a no-op until the row is cleared
 * (operationally: by deleting it via the SQLite CLI, or by burning the
 * secrets.db file).
 *
 * Conflict rule: never overwrites a key already present in the store.
 * Importer fills empty slots only. This means the store ALWAYS wins
 * over a legacy file — the operator may have already used the API to
 * set a value before the importer ran (race during a redeploy that
 * brought legacy files along), and we must not regress that write.
 *
 * Failure handling: per-source failures (parse errors, missing files)
 * are logged and continued. The whole pass succeeds even if some
 * sources are missing — the goal is to copy what's there, not enforce
 * that everything is there.
 *
 * After the scope-collapse refactor, the store is single-tier — the
 * process IS the workspace. The importer no longer routes writes
 * through a scope dimension.
 */
export interface ImporterResult {
    /** True when the importer was a no-op because meta.imported_legacy_at was already set. */
    skipped: boolean;
    /** Count of setting rows the importer wrote. */
    settings: number;
    /** Count of secret rows the importer wrote. */
    secrets: number;
    /** Sources that were read (file paths, normalized). For diagnostics. */
    sources: string[];
}
interface ImportContext {
    workspacePath?: string;
    /**
     * Root directory containing `.studiograph/user.json` and
     * `.studiograph/connectors/*.json`. Defaults to `os.homedir()` so the
     * production CLI doesn't need to think about it. Tests inject an
     * isolated temp dir here instead of mutating `process.env.HOME`, which
     * isn't safe to race across vitest workers.
     */
    homePath?: string;
    /**
     * When true, the importer treats process.env as a source. Useful in
     * Railway boot — env was provisioned by deploy.ts, and we want the
     * resolver to see those values for keys that don't yet have a row.
     *
     * Note: env values are also visible to the resolver directly without
     * being mirrored. We seed them into the store anyway so the audit log
     * captures the provisioning event, and so subsequent reads can be
     * answered without consulting `process.env`.
     */
    importFromEnv?: boolean;
}
/**
 * Touch every legacy source once and copy registry-mapped values into
 * the encrypted store. Safe to call repeatedly — guarded by
 * `meta.imported_legacy_at`. Caller (serve.ts) decides whether to log
 * the result; the importer itself is silent on success and
 * `console.warn`s on per-source parse failures.
 *
 * Returns counts so the caller can produce the boot one-liner the plan
 * specifies (`[secrets] Imported N settings, M secrets from legacy files`).
 */
export declare function runFirstRunImporter(ctx?: ImportContext): Promise<ImporterResult>;
/**
 * Test seam: clear the `imported_legacy_at` marker so the next call
 * re-runs the importer. Tests only — production callers should never
 * unmark a successful import.
 */
export declare function _resetImportedMarker(): void;
/**
 * Utility for tests + diagnostics — does the store look "fresh"? Used
 * by the boot path to decide whether to log the importer summary line
 * vs. silently confirm "already imported".
 */
export declare function importerHasRun(): boolean;
export {};
