import { BetterSqlite3Constructor } from "../driver-types.js";

//#region src/encryption/index.d.ts

/**
 * Cipher selection, validated against the real sqlite3mc vocabulary
 * (`'wxsqlite3'` is the library's name, not a cipher; the peer
 * rejects it with "Cipher 'wxsqlite3' unknown"). `'sqlcipher'` is the
 * Graphorin default (SQLCipher v4 compatible); `'chacha20'` is the
 * peer's own default cipher.
 *
 * @stable
 */
type EncryptionCipher = 'sqlcipher' | 'chacha20' | 'aes256cbc' | 'aes128cbc' | 'rc4';
/**
 * The cipher-selection PRAGMAs that must run **before** `PRAGMA key`
 * on a freshly opened connection. sqlite3mc defaults to
 * `chacha20`, so opening a SQLCipher-v4 database with `key` alone
 * reads garbage - every keyed open must pin the cipher first.
 *
 * @stable
 */
declare function cipherSelectionPragmas(cipher: EncryptionCipher): ReadonlyArray<string>;
/**
 * Encryption-at-rest configuration. Default `{ enabled: false }`.
 *
 * @stable
 */
type EncryptionConfig = {
  readonly enabled: false;
} | {
  readonly enabled: true;
  readonly cipher?: EncryptionCipher;
  /**
   * Resolves the passphrase at startup. Returns the raw passphrase
   * string (the caller is responsible for clearing it from memory
   * after the connection is open). Inputs typically come from a
   * `SecretValue` resolver in `@graphorin/security` or from an
   * operator-supplied env var.
   */
  readonly passphraseResolver: PassphraseResolver;
};
/**
 * Passphrase resolver shape. Implementations live in
 * `@graphorin/security` (`'env:GRAPHORIN_DB_PASSPHRASE'`,
 * `'keyring:graphorin/db'`, …). The resolver may return `Buffer` for
 * binary-keyed cipher variants.
 *
 * @stable
 */
type PassphraseResolver = () => Promise<string | Buffer>;
/**
 * Raised when the operator opts in to encryption-at-rest but the
 * cipher peer (`better-sqlite3-multiple-ciphers`) is missing. The
 * Phase 05 acceptance criteria require this to be a fatal startup
 * error - never silently downgrade to an unencrypted DB.
 *
 * @stable
 */
declare class CipherPeerMissingError extends Error {
  readonly name = "CipherPeerMissingError";
}
/**
 * Loads the cipher peer (`better-sqlite3-multiple-ciphers`). Lazy by
 * design - the import only fires when encryption-at-rest is enabled.
 *
 * @stable
 */
declare function loadCipherDriver(): Promise<BetterSqlite3Constructor>;
/**
 * Resolves the configured passphrase to a SQL-literal-ready value
 * suitable for `PRAGMA key = <literal>`. UTF-8 passphrases are returned
 * as a single-quoted SQL string with internal `'` doubled; binary keys
 * are returned in the cipher peer's hex form (`x'<hex>'`).
 *
 * @stable
 */
declare function resolvePassphrase(config: EncryptionConfig): Promise<string>;
//#endregion
export { CipherPeerMissingError, EncryptionCipher, EncryptionConfig, PassphraseResolver, cipherSelectionPragmas, loadCipherDriver, resolvePassphrase };
//# sourceMappingURL=index.d.ts.map