/** The narrow slice of `Collection` the migration pass needs (mirrors `fanout.ts`'s `CollectionHandle` narrowing). */
export interface SatelliteCekMigrationTarget {
    /** Public config snapshot (`Collection.getConfig()`) — used to confirm the handle is genuinely in per-record-CEK mode before walking. */
    getConfig(): {
        readonly perRecordKeys?: boolean;
    } | undefined;
    _applyCutoverTransform(transform: (doc: Record<string, unknown>) => Record<string, unknown>): Promise<number>;
}
export interface SatelliteCekMigrationResult {
    /** Records touched by this call (both freshly minted and already-migrated re-touches on a resumed run). */
    readonly migrated: number;
}
/**
 * Re-encrypt every record in `coll` under a per-record CEK. `coll` must be
 * a collection handle already opened with `perRecordKeys: true` — see the
 * file header for how the caller gets one past R-S7. Throws
 * `SatelliteConfigError` (does NOT proceed) if `coll` is not genuinely in
 * per-record-CEK mode — see the file header's mode-assertion note.
 * Idempotent/resumable: safe to call again after a partial failure. NOT
 * fenced against concurrent writers — see the file header's no-quiesce
 * precondition; run this before the collection serves traffic.
 *
 * @param name The satellite collection's name — used only for the error
 *   message below; identical to what the caller passed to `vault.collection()`.
 */
export declare function migrateSatelliteCek(name: string, coll: SatelliteCekMigrationTarget): Promise<SatelliteCekMigrationResult>;