/**
 * One-time local scrub of secrets already written to audit rows (T13857).
 *
 * Before T13855 the dispatch audit middleware stored mutation params verbatim
 * (`service connect --token`, `config set` values). T13855 redacts every new
 * write at the column; this pass rewrites the rows written before it, on each
 * device, with the same per-column transforms the column and the sync apply
 * path use ({@link COLUMN_TRANSFORMS}).
 *
 * - Local only: runs with the capture and side-effect triggers suspended, so
 *   no change is captured and peers never receive an op the `audit.immutable`
 *   merge rule would refuse (design note `t13857-audit-secret-scrub-design`).
 * - Runs once per store under {@link AUDIT_SCRUB_MARKER} in the scope's
 *   local-only meta table. A vault restore takes the key from the restored
 *   file, never from the live store (`FILE_STATE_KEYS`, T13864), so a
 *   snapshot taken before its scrub is scrubbed again on its next open.
 * - Rewrites only rows whose value changes; clean rows stay byte for byte.
 *
 * Loaded lazily by the store open pass, only when the marker is absent
 * ({@link auditScrubPending} in `schema.ts`).
 *
 * @module store/sync/audit-scrub
 * @task T13857
 * @epic T12323
 */
import type { DatabaseSync } from 'node:sqlite';
/** What {@link scrubAuditSecrets} did. */
export type AuditScrubReport = {
    readonly status: 'done';
    readonly rewritten: Readonly<Record<string, number>>;
} | {
    readonly status: 'already';
} | {
    readonly status: 'skipped';
    readonly reason: string;
};
/**
 * The one-time scrub: every text value its {@link COLUMN_TRANSFORMS} entry
 * changes is rewritten, in one `BEGIN IMMEDIATE` (or
 * the caller's transaction) with capture and side-effect triggers suspended,
 * then the marker is recorded.
 *
 * @param db - The store, after its migrations.
 * @returns What the scrub did.
 */
export declare function scrubAuditSecrets(db: DatabaseSync): AuditScrubReport;
//# sourceMappingURL=audit-scrub.d.ts.map