/**
 * Credentials this app signs (MCP OAuth access JWTs, connect tokens) are
 * stateless, so an email rekey cannot recall the ones already issued for the
 * old address. Rekey records the address here inside its own transaction.
 * Admission then refuses credentials for it signed no later than that, and
 * issuance refuses the address until an account holds it again.
 */
import type { DbExec } from "../db/client.js";
export declare const IDENTITY_RETIRED_EMAILS_CREATE_SQL = "CREATE TABLE IF NOT EXISTS identity_retired_emails (\n  -- guard:allow-identity-column \u2014 the retired address itself; rekey and offboarding never rewrite it\n  email TEXT PRIMARY KEY,\n  retired_at BIGINT NOT NULL\n)";
export declare const identityRetiredEmailsStore: import("../db/store-registry.js").Store;
export declare function ensureTable(): Promise<void>;
/**
 * Key for `pg_advisory_xact_lock(hashtextextended(key, 0))`. Rekey takes it
 * for both addresses, offboarding for the removed member, and credential
 * issuance for its owner, each before any row lock, so issuance cannot write
 * a grant for an address mid-rekey or mid-offboard.
 */
export declare function identityCredentialLockKey(email: string): string;
/**
 * Epoch milliseconds of the latest rekey away from `email`, or null when no
 * rekey has. A database no rekey has touched has no table, which is the same
 * answer.
 */
export declare function readEmailRetiredAt(exec: DbExec, email: string): Promise<number | null>;