/**
 * Credential retention — expired sessions and tokens (issue #2375, finding F2).
 *
 * `SessionCollection.deleteExpired()`, `MagicLinkTokenCollection.deleteExpired()`
 * and `CliAuthRequestCollection.deleteExpired()` all existed, and every one of
 * them waited for an application to remember to call it. Expired credential
 * rows are the worst kind of unbounded growth: they are worthless the moment
 * they expire and they are exactly the rows an attacker would like to still
 * find in the table.
 *
 * This module contributes them to the framework retention sweep, so
 * `smrt db:prune` and the jobs `TaskRunner`'s periodic sweep reap them like
 * every other framework-owned table.
 *
 * The package entry point registers all three on import (see `index.ts`), so
 * any process that loaded `@happyvertical/smrt-users` contributes them.
 * Registration is not scheduling: nothing is deleted until something runs a
 * sweep, and a policy can turn any task off by name. Task names are prefixed
 * with the owning package's short name, because the registry is one
 * process-global namespace shared with every other package.
 *
 * @see https://github.com/happyvertical/smrt/issues/2375
 * @packageDocumentation
 */
/** Retention task name for expired and revoked sessions. */
export declare const SESSIONS_RETENTION_TASK = "users-sessions";
/** Retention task name for expired magic-link tokens. */
export declare const MAGIC_LINK_RETENTION_TASK = "users-magic-link-tokens";
/** Retention task name for expired CLI device-code requests. */
export declare const CLI_AUTH_RETENTION_TASK = "users-cli-auth-requests";
/** Every task name {@link registerUserRetentionTasks} installs. */
export declare const USER_RETENTION_TASKS: readonly ["users-sessions", "users-magic-link-tokens", "users-cli-auth-requests"];
/**
 * Register session and token expiry with the framework retention sweep.
 *
 * Idempotent: re-registering replaces the previous tasks.
 *
 * Each task deletes only rows that have already expired — there is no
 * retention window to configure, because an expired credential has no value
 * to retain. Applications that keep expired sessions for audit should opt the
 * task out (`tasks: { 'users-sessions': false }`) and archive them
 * themselves.
 */
export declare function registerUserRetentionTasks(): void;
/** Remove the credential retention tasks from the framework sweep. */
export declare function unregisterUserRetentionTasks(): void;
//# sourceMappingURL=retention.d.ts.map