/**
 * Core script: db-migrate-encrypt-oauth-tokens
 *
 * One-shot, in-place migration: encrypt any plaintext `tokens` payloads in the
 * `oauth_tokens` table with the same AES-256-GCM scheme the secrets vault and
 * per-user credentials use.
 *
 * Background. `oauth_tokens` historically stored the full OAuth bundle —
 * including long-lived Google refresh tokens — as plaintext JSON. Writes are
 * now encrypted at rest, and reads transparently fall back to plaintext, so
 * this migration is OPTIONAL: it re-encrypts existing rows so a leaked DB
 * backup / pg_dump / read replica no longer exposes usable refresh/access
 * tokens.
 *
 * Non-destructive: it only rewrites the `tokens` value of each row in place
 * (no row is dropped). Idempotent: already-encrypted rows are skipped.
 *
 * IMPORTANT: run with the SAME SECRETS_ENCRYPTION_KEY / BETTER_AUTH_SECRET the
 * app uses, or the app won't be able to decrypt the result. The script refuses
 * to run without an explicit key.
 *
 * Usage:
 *   DATABASE_URL=postgres://... SECRETS_ENCRYPTION_KEY=... pnpm action db-migrate-encrypt-oauth-tokens
 *   pnpm action db-migrate-encrypt-oauth-tokens --db ./data/app.db
 *   pnpm action db-migrate-encrypt-oauth-tokens --dry-run
 */
export default function dbMigrateEncryptOAuthTokens(args: string[]): Promise<void>;
//# sourceMappingURL=migrate-encrypt-oauth-tokens.d.ts.map