/**
 * EncryptedSqliteBackend (v2.19)
 *
 * Extends v2.16 SQLite multi-backend to support transparent SQLCipher
 * encryption of `profiles.db` (and any other SQLite file the caller wants
 * to encrypt). Two implementations:
 *
 * - {@link NativeSqliteBackend} — opens via the existing v2.16
 *   `detectSqliteBackend()` (tries `node:sqlite`, falls back to
 *   `better-sqlite3`). No encryption.
 *
 * - {@link CipherSqliteBackend} — opens via the optional
 *   `better-sqlite3-multiple-ciphers` package (SQLCipher build of
 *   better-sqlite3) and runs `PRAGMA cipher='sqlcipher'` + `PRAGMA key=...`
 *   immediately after open. Throws a clear error when the dependency is
 *   not installed.
 *
 * Selection is driven by {@link detectEncryptedBackend}: if a non-empty
 * `cipherKey` is supplied, it returns the cipher backend; otherwise the
 * native backend (v2.18 behavior, plaintext).
 *
 * The two backends return the same {@link SQLiteConnection} interface, so
 * consumers like {@link ProfileStore} can swap them transparently.
 */
import { type SQLiteConnection } from '../adapters/sqlite/types.js';
export interface EncryptedSqliteBackend {
    readonly name: 'native' | 'cipher';
    open(dbPath: string, options: {
        readonly?: boolean;
        cipherKey?: string;
    }): Promise<SQLiteConnection>;
}
export declare class NativeSqliteBackend implements EncryptedSqliteBackend {
    readonly name: "native";
    open(dbPath: string, options: {
        readonly?: boolean;
        cipherKey?: string;
    }): Promise<SQLiteConnection>;
}
export declare class CipherSqliteBackend implements EncryptedSqliteBackend {
    readonly name: "cipher";
    open(dbPath: string, options: {
        readonly?: boolean;
        cipherKey?: string;
    }): Promise<SQLiteConnection>;
}
/**
 * Pick the right backend for the given key.
 *
 * - Non-empty `cipherKey` → {@link CipherSqliteBackend} (SQLCipher).
 * - Empty/undefined → {@link NativeSqliteBackend} (v2.16 multi-backend).
 *
 * Note: this returns a fresh instance each call. The `CipherSqliteBackend`
 * has no per-instance state, so this is cheap. If you want to swap at
 * runtime, just call this factory again.
 */
export declare function detectEncryptedBackend(cipherKey: string | undefined): EncryptedSqliteBackend;
//# sourceMappingURL=encrypted-sqlite.d.ts.map