import { BetterSqlite3Constructor, BetterSqlite3Database } from "./driver-types.js";
import { EncryptionConfig } from "./encryption/index.js";

//#region src/audit-db.d.ts

/**
 * Options for {@link openAuditDatabase}. The audit database is **always
 * encrypted** (DEC-124); if the cipher peer is missing the call fails
 * fast with {@link CipherPeerMissingError}.
 *
 * @stable
 */
interface OpenAuditDatabaseOptions {
  readonly path: string;
  /** Cipher / passphrase resolver - required because audit.db is encrypted. */
  readonly encryption: Extract<EncryptionConfig, {
    enabled: true;
  }>;
  /** Optional driver override for tests. */
  readonly driver?: BetterSqlite3Constructor;
  /**
   * Optional cipher-driver loader override. When unset the function
   * defers to the canonical {@link loadCipherDriver}. Used by the test
   * suite to simulate a missing cipher peer without uninstalling the
   * package from the workspace.
   *
   * @internal
   */
  readonly cipherLoader?: () => Promise<BetterSqlite3Constructor>;
}
/**
 * Lightweight handle returned by {@link openAuditDatabase}. The audit
 * package (Phase 03) owns the schema; this module only opens the file
 * with the cipher peer and applies WAL hardening so the consumer can
 * focus on appending audit records.
 *
 * @stable
 */
interface AuditDatabase {
  readonly path: string;
  readonly db: BetterSqlite3Database;
  close(): void;
}
/**
 * Opens the encrypted `audit.db` file.
 *
 * @stable
 */
declare function openAuditDatabase(options: OpenAuditDatabaseOptions): Promise<AuditDatabase>;
//#endregion
export { AuditDatabase, OpenAuditDatabaseOptions, openAuditDatabase };
//# sourceMappingURL=audit-db.d.ts.map