/**
 * Read-flip helpers — Phase 6 of the secrets refactor.
 *
 * Call sites that historically read directly from `~/.studiograph/user.json`
 * / `workspace.json` / `process.env.*` route through this module so the
 * flip is uniform across the codebase.
 *
 * Contract: every helper here returns `undefined` when the resolver
 * returns `unset` (or when the store hasn't been initialized yet —
 * very early boot or test harness without a store). Callers MUST fall
 * back to their pre-existing legacy read in that case. This is the
 * transitional safety net documented in the plan: if the importer
 * hasn't run yet (boot race, mis-provisioned redeploy), the resolver
 * sees empty slots and we don't want to regress to "no value at all".
 *
 * When the resolver returns a value, callers MUST use it and skip the
 * legacy read. The store is the source of truth in production.
 *
 * Why a thin wrapper rather than inlining `getSettingsResolver()?.resolve()`
 * at every call site:
 *   1. Single place to handle the "store not yet initialized" guard.
 *   2. Single place to flip the implementation again in Phase 9 (when
 *      legacy fallbacks are removed).
 *   3. Concise call sites: `tryResolve('model.anthropic.api_key')` is
 *      shorter than the resolver dance.
 *
 * Historical note: the `STUDIOGRAPH_NEW_STORE` env flag previously
 * gated these helpers (returned undefined when off). The flag was
 * removed once Phase 6 was proven stable in production — the store is
 * now unconditional. The env var can still be set on Railway services
 * for backwards-compat; it is silently ignored.
 */
import type { ResolverContext } from './SettingsResolver.js';
/**
 * Try to resolve a value through the new store. Returns `undefined`
 * when the flag is off OR the resolver returns unset. Callers handle
 * `undefined` by falling back to their legacy reader.
 *
 * For non-secret values, this hits the `settings` table directly via
 * the resolver's read path. The value type is whatever was JSON-stored,
 * cast to T at the boundary.
 *
 * For secret values, this calls `unsafeGetForResolver` through the
 * resolver — same access pattern as the legacy reader, except the
 * value lands from an encrypted SQLite row rather than a 0o600 JSON
 * file. The "unsafe" prefix on the underlying call is a marker for
 * "value crosses the resolver boundary" — UI/API callers must use
 * `describe()` instead and never touch this helper.
 */
export declare function tryResolve<T = string>(key: string, ctx?: ResolverContext): T | undefined;
/**
 * Same shape but also returns the resolution source. Useful for
 * surfaces that want to show a "shadowed by environment" banner in
 * the UI without re-doing the lookup.
 */
export declare function tryResolveWithSource<T = string>(key: string, ctx?: ResolverContext): {
    value: T | undefined;
    source: 'env' | 'store' | 'default' | 'unset';
} | undefined;
