/**
 * KeyRotator (v2.20)
 *
 * Re-encrypts an SQLCipher-protected SQLite DB under a new key while
 * preserving all data. Atomic-rename strategy:
 *
 *   1. Open source DB with `oldKey` (decryption)
 *   2. Stream all rows out (via the existing SQLiteConnection interface)
 *   3. Open a temp `*.rotating.tmp` file with `newKey`
 *   4. Re-create schema + reinsert all rows
 *   5. atomically rename tmp → original path
 *   6. close both connections
 *
 * On any failure during steps 3-5, the original DB is left untouched and
 * the tmp file is renamed to `<path>.rotating.failed` for forensic recovery.
 */
export type RotationKind = 'profile' | 'templates' | 'history';
export interface RotationResult {
    rowsCopied: number;
    durationMs: number;
}
export declare class KeyRotationError extends Error {
    readonly kind: RotationKind;
    readonly cause?: unknown | undefined;
    constructor(message: string, kind: RotationKind, cause?: unknown | undefined);
}
/**
 * Rotate a single DB. `oldKey === undefined` means the DB is currently
 * plaintext — rotation in that case simply re-creates the file under
 * SQLCipher using `newKey`.
 */
export declare function rotateDbKey(dbPath: string, kind: RotationKind, oldKey: string | undefined, newKey: string): Promise<RotationResult>;
/**
 * Convenience facade used by ProfileManager / QueryAnalyzer / MCP tools.
 */
export declare class KeyRotator {
    rotate(dbPath: string, kind: RotationKind, oldKey: string | undefined, newKey: string): Promise<RotationResult>;
}
//# sourceMappingURL=key-rotator.d.ts.map