/**
 * `neotoma db migrate-encryption` — bidirectional bulk encryption migration.
 *
 * encrypt: reads plaintext values from ENCRYPTED_COLUMNS, writes encrypted values.
 * decrypt: reads encrypted values from ENCRYPTED_COLUMNS, writes plaintext values.
 *
 * The command operates directly on the SQLite file (no running server required)
 * and requires the same key configuration used by the runtime
 * (NEOTOMA_KEY_FILE_PATH or NEOTOMA_MNEMONIC + optional NEOTOMA_MNEMONIC_PASSPHRASE).
 */
import type { Command } from "commander";
type MigrateOpts = {
    direction: "encrypt" | "decrypt";
    dbPath: string;
    keyFilePath?: string;
    mnemonic?: string;
    mnemonicPassphrase?: string;
    dryRun?: boolean;
};
type ColumnResult = {
    table: string;
    column: string;
    processed: number;
    skipped: number;
};
export declare function runMigrateEncryption(opts: MigrateOpts): ColumnResult[];
export type DbCliHooks = {
    resolveDbPath: () => Promise<string>;
};
export declare function registerDbCommand(program: Command, hooks: DbCliHooks): void;
export {};
//# sourceMappingURL=db.d.ts.map