import Database from 'better-sqlite3-multiple-ciphers';
/**
 * Metadata for a named vault (stored in the registry).
 * Master keys are NEVER stored — the user must provide them.
 */
export interface VaultInfo {
    /** Unique vault name (e.g. "production", "staging") */
    name: string;
    /** Database file path relative to the data directory */
    dbPath: string;
    /** Hex-encoded PBKDF2 salt (unique per vault) */
    salt: string;
    /** ISO timestamp of when the vault was created */
    createdAt: string;
}
/**
 * Manages multiple named vaults, each with its own SQLite database
 * and encryption key. The registry tracks vault metadata but NEVER
 * stores master keys.
 *
 * Layout:
 *   .aegis/vaults/<name>.db    — all vaults (including "default")
 *   .aegis/vaults.json         — vault registry
 */
export declare class VaultManager {
    private dataDir;
    private registryPath;
    private vaultsDir;
    constructor(dataDir: string);
    /**
     * Create a new named vault with its own database and salt.
     * Returns the generated salt (the caller provides the master key).
     */
    create(name: string, masterKey?: string): {
        salt: string;
        dbPath: string;
    };
    /**
     * List all registered vaults.
     */
    list(): VaultInfo[];
    /**
     * Remove a named vault and delete its database file.
     */
    remove(name: string): void;
    /**
     * Get metadata for a named vault.
     */
    getVaultInfo(name: string): VaultInfo | undefined;
    /**
     * Open the SQLite database for a named vault.
     * Caller is responsible for closing the returned database.
     */
    openDb(name: string, masterKey?: string): Database.Database;
    /**
     * Get the salt for a named vault.
     */
    getSalt(name: string): string;
    private loadRegistry;
    private saveRegistry;
}
//# sourceMappingURL=vault-manager.d.ts.map