import { type HygieneCommonOptions } from "../shared.js";
export interface CleanupUsersOptions extends HygieneCommonOptions {
    /** Inactivity threshold in days. Default 365 (one year). */
    notActiveDays?: number;
    /** Cap on deletions. Default 25. */
    maxDeletions?: number;
    /** Include administrators. Strongly discouraged. */
    includeAdmins?: boolean;
    /** Include service accounts (regex match). Off by default. */
    includeServiceAccounts?: boolean;
    /** Use UserProfile.lastActivityDate instead of lastLoginDate. */
    useActivityDate?: boolean;
    concurrency?: number;
    whatIf?: boolean;
    allowWrite?: boolean;
    baseline?: boolean;
    output?: string;
    format?: "json" | "csv" | "markdown";
}
export interface UserCleanupAction {
    user: string;
    daysSinceActive: number | null;
    status: "deleted" | "what-if" | "failed";
    error?: string;
}
/**
 * Purge stale users. Pairs with `audit stale-users list`.
 *
 * Safety rails:
 *   - Default threshold is **one year** (365 days), much higher than
 *     the audit's 180 default. Deleting users is more destructive
 *     than flagging them.
 *   - `--max-deletions` defaults to 25 per run (vs. 100 in
 *     find-replace) — same reasoning.
 *   - Administrators excluded by default; pass `--include-admins`
 *     with caution.
 *   - Service accounts excluded by default; OAuth client-credentials
 *     auth doesn't update `lastLoginDate` so service accounts will
 *     ALWAYS look stale.
 *   - `--allow-write` (or env `allowWrite`) required outside `--what-if`.
 *
 * Notes:
 *   - The Authoring API's `deleteUser` mutation removes the user.
 *     Items the user authored aren't deleted (they're owned by the
 *     tenant), but `__Created by` / `__Updated by` references become
 *     stale strings rather than resolvable user accounts.
 */
export declare const runCleanupUsers: (options: CleanupUsersOptions) => Promise<UserCleanupAction[]>;