/**
 * Database Module
 *
 * Provides SQLite database management with PQC encryption at rest for
 * the Firefox Relay MCP Server. Implements a robust database layer with:
 * - Automatic schema initialization
 * - Prepared statements for SQL injection prevention
 * - PQC encryption for sensitive data fields
 * - Transaction support
 * - Connection pooling
 *
 * Follows golden-standard programming practices for maximal data integrity
 * and security.
 */
import Database from 'better-sqlite3';
import { DatabaseRelayAddress, DatabaseEmailLog, DatabaseApiKey, DatabaseAuditLog } from '../types';
import { Configuration } from '../config';
/**
 * Custom error for database-related failures
 */
export declare class DatabaseError extends Error {
    readonly code?: string | undefined;
    readonly cause?: Error | undefined;
    constructor(message: string, code?: string | undefined, cause?: Error | undefined);
}
/**
 * Custom error for database connection failures
 */
export declare class ConnectionError extends DatabaseError {
    constructor(message?: string, cause?: Error);
}
/**
 * Custom error for database query failures
 */
export declare class QueryError extends DatabaseError {
    readonly sql: string;
    constructor(message: string, sql: string, cause?: Error);
}
/**
 * Custom error for not found entities
 */
export declare class NotFoundError extends DatabaseError {
    constructor(entityType: string, identifier: string | number);
}
/**
 * Main database class
 *
 * Provides a high-level interface for database operations with automatic
 * encryption/decryption of sensitive fields and connection management.
 */
export declare class AnonSecDatabase {
    private db;
    private config;
    private encryptionKey;
    /**
     * Create a new database instance
     *
     * @param config - Configuration instance
     * @param dbPath - Optional database path override
     */
    constructor(config: Configuration, dbPath?: string);
    /**
     * Ensure the database directory exists
     */
    private ensureDirectory;
    /**
     * Configure database settings
     */
    private configureDatabase;
    /**
     * Initialize database schema
     */
    private initializeSchema;
    /**
     * Get the underlying database instance
     */
    getDatabase(): Database.Database;
    /**
     * Check if encryption is enabled
     */
    isEncryptionEnabled(): boolean;
    /**
     * Insert a new relay address
     */
    insertRelayAddress(data: Omit<DatabaseRelayAddress, 'id'>): DatabaseRelayAddress;
    /**
     * Get a relay address by ID
     */
    getRelayAddressById(id: number): DatabaseRelayAddress | null;
    /**
     * Get a relay address by full address
     */
    getRelayAddressByFullAddress(fullAddress: string): DatabaseRelayAddress | null;
    /**
     * List all relay addresses
     */
    listRelayAddresses(enabledOnly?: boolean): DatabaseRelayAddress[];
    /**
     * Update a relay address
     */
    updateRelayAddress(id: number, updates: Partial<Omit<DatabaseRelayAddress, 'id' | 'relay_id' | 'full_address'>>): DatabaseRelayAddress | null;
    /**
     * Delete a relay address
     */
    deleteRelayAddress(id: number): boolean;
    /**
     * Encrypt a field if encryption is enabled
     */
    private encryptField;
    /**
     * Decrypt a field if it was encrypted
     */
    private decryptField;
    /**
     * Insert a new email log
     */
    insertEmailLog(data: Omit<DatabaseEmailLog, 'id' | 'body_encrypted' | 'headers_encrypted'>): DatabaseEmailLog;
    /**
     * Get an email log by ID
     */
    getEmailLogById(id: number): DatabaseEmailLog | null;
    /**
     * Get email logs by relay address ID
     */
    getEmailLogsByRelayAddressId(relayAddressId: number, limit?: number, offset?: number): DatabaseEmailLog[];
    /**
     * Get the latest email log for a relay address
     */
    getLatestEmailLogByRelayAddressId(relayAddressId: number): DatabaseEmailLog | null;
    /**
     * Get all email logs with OTP codes
     */
    getOtpEmailLogs(limit?: number): DatabaseEmailLog[];
    /**
     * Get the latest OTP email
     */
    getLatestOtpEmail(): DatabaseEmailLog | null;
    /**
     * Update email log read status
     */
    markEmailAsRead(id: number): boolean;
    /**
     * Insert a new API key
     */
    insertApiKey(data: Omit<DatabaseApiKey, 'id'>): DatabaseApiKey;
    /**
     * Get an API key by key hash
     */
    getApiKeyByHash(keyHash: string): DatabaseApiKey | null;
    /**
     * List all API keys
     */
    listApiKeys(activeOnly?: boolean): DatabaseApiKey[];
    /**
     * Update API key last used timestamp
     */
    updateApiKeyLastUsed(id: number): boolean;
    /**
     * Deactivate an API key
     */
    deactivateApiKey(id: number): boolean;
    /**
     * Delete an API key
     */
    deleteApiKey(id: number): boolean;
    /**
     * Insert a new audit log entry
     */
    insertAuditLog(data: Omit<DatabaseAuditLog, 'id' | 'details_encrypted'>): DatabaseAuditLog;
    /**
     * List audit logs with pagination
     */
    listAuditLogs(action?: string, limit?: number, offset?: number): DatabaseAuditLog[];
    /**
     * Execute operations in a transaction
     */
    transaction<T>(operations: () => T): T;
    /**
     * Close the database connection
     */
    close(): void;
    /**
     * Check database health
     */
    healthCheck(): boolean;
    /**
     * Get database statistics
     */
    getStats(): {
        relayAddresses: number;
        emailLogs: number;
        apiKeys: number;
        auditLogs: number;
        databaseSize: number;
    };
    /**
     * Delete all data (DANGEROUS - use with caution)
     */
    clearAllData(): void;
    /**
     * Delete old email logs (retention policy)
     */
    deleteOldEmailLogs(days: number): number;
    /**
     * Delete old audit logs (retention policy)
     */
    deleteOldAuditLogs(days: number): number;
}
/**
 * Get the singleton database instance
 */
export declare function getDatabase(config?: Configuration): AnonSecDatabase;
/**
 * Reset the singleton instance (useful for testing)
 */
export declare function resetDatabase(): void;
export default AnonSecDatabase;
//# sourceMappingURL=index.d.ts.map