import { Kysely } from "kysely";
import { Database } from "../db";
/**
 * Soft-revoke every unrevoked refresh token belonging to a user.
 *
 * Exact tenant + user predicates rather than a `q` filter: the Lucene grammar
 * splits on ` OR ` before tokenizing, so a crafted user id can widen the match
 * to another user's rows.
 *
 * `revoked_at_ts IS NULL` keeps this idempotent and concurrency-safe — a second
 * revocation cannot overwrite the audit timestamp written by the first.
 */
export declare function revokeByUser(db: Kysely<Database>): (tenant_id: string, user_id: string, revoked_at: string) => Promise<number>;