/**
 * Master-key bootstrap.
 *
 * Resolution order:
 *   1. STUDIOGRAPH_MASTER_KEY env var (base64-encoded 32 bytes).
 *      Always wins. In production this is the only acceptable source.
 *   2. ~/.studiograph/master-key file (mode 0600). Local-dev only.
 *      If absent, a fresh 32-byte key is generated, written, and a one-time
 *      warning printed to stderr with backup instructions.
 *
 * Production gate: when RAILWAY_ENVIRONMENT is set and the env-var is
 * unset, throw. We do NOT silently generate a key in production — that
 * would be ephemeral, would invalidate every encrypted row on the next
 * restart, and would mask a misconfigured deploy.
 */
export interface LoadedMasterKey {
    key: Uint8Array;
    /** Where it came from; useful for boot logging without leaking the value. */
    source: 'env' | 'file' | 'generated';
    /** Path to the on-disk file (only set when source !== 'env'). */
    filePath?: string;
}
/**
 * Load the master key. Idempotent — safe to call multiple times.
 *
 * In a long-running process you should call once at boot and cache the
 * result. The local-dev side-effect (file generate + warn) only fires if
 * the file does not exist.
 */
export declare function loadMasterKey(opts?: {
    filePath?: string;
}): LoadedMasterKey;
/**
 * Optional companion: load a previous master key for rotation transitions.
 * Returns undefined when STUDIOGRAPH_MASTER_KEY_PREVIOUS is unset — that's
 * the steady state. Caller must tolerate undefined.
 */
export declare function loadPreviousMasterKey(): Uint8Array | undefined;
