/**
 * Core script: db-migrate-encrypt-credentials
 *
 * One-shot, in-place migration: encrypt any plaintext per-user / per-org
 * credential rows in the `settings` table (`u:<email>:credential:<KEY>` and
 * `o:<orgId>:credential:<KEY>`) with the same AES-256-GCM scheme the secrets
 * vault uses.
 *
 * Background. `resolveCredential` / `saveCredential` historically stored
 * third-party API keys as plaintext JSON in `settings`. Writes are now
 * encrypted at rest, and reads transparently fall back to plaintext, so this
 * migration is OPTIONAL — it re-encrypts existing rows so a leaked DB
 * backup / pg_dump / read replica no longer exposes plaintext keys.
 *
 * Non-destructive: it only rewrites the `value` of credential rows in place
 * (no row is dropped). Idempotent: already-encrypted rows are skipped.
 *
 * IMPORTANT: run with the SAME SECRETS_ENCRYPTION_KEY / BETTER_AUTH_SECRET the
 * app uses, or the app won't be able to decrypt the result. The script refuses
 * to run without an explicit key.
 *
 * Usage:
 *   DATABASE_URL=postgres://... SECRETS_ENCRYPTION_KEY=... pnpm action db-migrate-encrypt-credentials
 *   pnpm action db-migrate-encrypt-credentials --db ./data/app.db
 *   pnpm action db-migrate-encrypt-credentials --dry-run
 */
export default function dbMigrateEncryptCredentials(args: string[]): Promise<void>;
//# sourceMappingURL=migrate-encrypt-credentials.d.ts.map