/**
 * Periodic cleanup of orphaned ephemeral keys and secret outputs.
 *
 * Runs on a configurable interval (default: 1 hour) and deletes rows
 * from run_ephemeral_keys and run_secret_outputs older than a configurable
 * threshold (default: 24 hours). This catches data from crashed or
 * abandoned runs whose normal cleanup never fired.
 */
import type { Kysely } from 'kysely';
import type { Database } from '../db/types.js';
export interface SecretCleanupDeps {
    db: Kysely<Database>;
    /** Max age in hours before rows are considered orphaned. Default: 24 */
    maxAgeHours?: number;
    /** Optional logger for cleanup messages */
    logger?: {
        info(msg: string, meta?: Record<string, unknown>): void;
        warn(msg: string, meta?: Record<string, unknown>): void;
    };
}
/**
 * Delete orphaned ephemeral keys and secret outputs older than maxAgeHours.
 *
 * @returns Count of deleted rows from each table
 */
export declare function cleanupOrphanedSecrets(db: Kysely<Database>, maxAgeHours?: number): Promise<{
    keysDeleted: number;
    outputsDeleted: number;
}>;
/**
 * Build a per-tick handler for the orphan-secret-cleanup scheduled job.
 *
 * The cadence and the periodic wrapper itself live in
 * `packages/orchestrator/src/queue/scheduled-job.ts` — this factory
 * just produces the tick function. Success is logged only when rows
 * were actually deleted to keep the hourly log line noise-free on an
 * idle orchestrator.
 */
export declare function createOrphanSecretCleanupHandler(deps: SecretCleanupDeps): () => Promise<void>;
//# sourceMappingURL=cleanup.d.ts.map