import type { QueryBuilder } from '@atlex/orm';
import type { RefreshTokenRecord } from './RefreshTokenRecord.js';
/**
 * Stores refresh-token metadata for rotation, reuse detection, and revocation.
 */
export declare class RefreshTokenRepository {
    private readonly mode;
    private readonly memory;
    private readonly table?;
    private readonly query?;
    /**
     * @param options - `memory` for tests, or `database` with a query factory.
     */
    constructor(options: {
        readonly mode: 'memory';
    } | {
        readonly mode: 'database';
        readonly table: string;
        readonly query: () => QueryBuilder;
    });
    /**
     * Persists a refresh token row.
     *
     * @param userId - Owner id.
     * @param familyId - Token family id.
     * @param jti - JWT id claim.
     * @param expiresAt - Absolute expiry instant.
     */
    create(userId: string | number, familyId: string, jti: string, expiresAt: Date): Promise<void>;
    /**
     * @param jti - JWT id.
     * @returns Row or null.
     */
    find(jti: string): Promise<RefreshTokenRecord | null>;
    /**
     * Marks a single refresh token as revoked.
     *
     * @param jti - JWT id.
     */
    revoke(jti: string): Promise<void>;
    /**
     * Revokes every token in a rotation family.
     *
     * @param familyId - Family UUID.
     */
    revokeFamily(familyId: string): Promise<void>;
    /**
     * Revokes all refresh tokens owned by a user.
     *
     * @param userId - Owner id.
     */
    revokeAllForUser(userId: string | number): Promise<void>;
    /**
     * @param jti - JWT id.
     * @returns True when revoked or missing.
     */
    isRevoked(jti: string): Promise<boolean>;
    /**
     * Deletes expired rows.
     *
     * @returns Number of deleted rows.
     */
    deleteExpired(): Promise<number>;
    /**
     * @returns New cryptographically random family id.
     */
    static newFamilyId(): string;
}
//# sourceMappingURL=RefreshTokenRepository.d.ts.map