import Database from 'better-sqlite3-multiple-ciphers';
import type { AegisConfig } from './config.js';
/**
 * Derive a 256-bit database encryption key from the master key and salt.
 * Uses a separate derivation context ("-db" suffix on salt) so the DB key
 * is independent from the credential encryption key, even though both
 * originate from the same master secret.
 */
export declare function deriveDbKey(masterKey: string, salt: string): Buffer;
/**
 * Open the SQLite database for the active vault.
 * Uses VaultManager to resolve vault name → database path.
 * Falls back to `.aegis/aegis.db` only if no vaults exist (pre-init state).
 *
 * When a master key is available, the database is encrypted at rest using
 * ChaCha20-Poly1305 (sqleet cipher via SQLite3MultipleCiphers). The encryption
 * key is derived from the master key using PBKDF2-SHA512 with a separate
 * salt context ("-db") to isolate it from credential encryption keys.
 */
export declare function getDb(config: AegisConfig): Database.Database;
/**
 * Get the salt for the active vault.
 * Returns the vault-specific salt from the registry, or the env salt for fallback.
 */
export declare function getVaultSalt(config: AegisConfig): string;
export declare function migrate(db: Database.Database): void;
//# sourceMappingURL=db.d.ts.map