/**
 * Railway-secret provisioning helpers.
 *
 * Phase 2 of the secrets refactor: every Railway deploy needs both
 * STUDIOGRAPH_JWT_SECRET (existing, plan §1) and STUDIOGRAPH_MASTER_KEY
 * (new — encrypts secrets.db) provisioned. We generate them client-side
 * via crypto.randomBytes(32) and POST through the existing GraphQL
 * variableCollectionUpsert mutation.
 *
 * Idempotent: pulls the current variable list first; only sets the keys
 * that are missing. Caller controls how missing vars are surfaced
 * (auto-provision in deploy.ts, prompt in redeploy.ts).
 */
export type RailwayQuery = (query: string, variables?: Record<string, unknown>) => Promise<any>;
export interface RailwayServiceContext {
    projectId: string;
    serviceId: string;
    environmentId: string;
}
/**
 * Variables our deploy paths must guarantee exist. Pre-approved set.
 * Extend here when a new bootstrap-classified env-var lands in the
 * registry.
 */
export declare const REQUIRED_RAILWAY_SECRETS: ReadonlyArray<{
    name: string;
    /** Generator: returns a base64-encoded 32-byte secret. */
    generate: () => string;
    /** Human description for the audit log / runbook. */
    description: string;
}>;
/**
 * Read the current variable map for a Railway service+environment.
 *
 * Railway's GraphQL exposes per-service variables via the `variables`
 * query. The shape changed across API versions; this helper deals with
 * the modern projectId/environmentId/serviceId triple.
 */
export declare function fetchRailwayVariables(query: RailwayQuery, ctx: RailwayServiceContext): Promise<Record<string, string>>;
/**
 * Determine which of the required secrets are missing from the supplied
 * variable map. Empty-string counts as missing — Railway sometimes emits
 * empty values for variables that were defined but never set.
 */
export declare function missingRequiredSecrets(existing: Record<string, string>): typeof REQUIRED_RAILWAY_SECRETS;
/**
 * Provision any required secret that is missing from the service's
 * environment. Returns the names of the secrets that were generated and
 * set on this call (an empty array means everything was already set).
 *
 * Idempotent — a re-deploy that already has both vars set is a no-op.
 */
export declare function provisionRequiredRailwaySecrets(query: RailwayQuery, ctx: RailwayServiceContext): Promise<string[]>;
