import type Redis from 'ioredis';
import type { SnapshotEnvelope } from './snapshot.envelope';
export declare const SNAP_PREFIX = "authz:snap:";
export declare const CURRENT_PREFIX = "authz:user:";
export declare const ROLE_PREFIX = "authz:role:";
export declare const DEFAULT_SNAPSHOT_TTL_SEC = 60;
export declare class RedisSnapshotStore {
    private readonly redis;
    constructor(redis: Redis);
    /** Store the envelope + point the user's `current` pointer at it (atomic pipeline). */
    put(env: SnapshotEnvelope, ttlSec?: number): Promise<void>;
    getBySnapId(snapId: string): Promise<SnapshotEnvelope | null>;
    /** Resolve the current snapId for (user, tenant) then load the envelope (pipelined). */
    getCurrent(userId: string, tenantId?: string): Promise<SnapshotEnvelope | null>;
    /** Member set TTL — refreshed on each index write so it outlives active snapshots but
     *  doesn't grow unbounded (a member that stops being snapshotted ages out). */
    static readonly ROLE_INDEX_TTL_SEC = 3600;
    indexRoleMember(tier: string, roleId: string, userId: string): Promise<void>;
    usersForRole(tier: string, roleId: string): Promise<string[]>;
    /** Evict every snapshot of a user across tenants (SCAN the `current` pointers). */
    revokeUser(userId: string): Promise<number>;
    /** Evict one (user, tenant) snapshot. */
    revokeUserTenant(userId: string, tenantId: string): Promise<void>;
    /** Cascade a role revoke to all its members (reverse-index lookup → per-user evict). */
    revokeRole(tier: string, roleId: string): Promise<number>;
}
//# sourceMappingURL=snapshot.store.d.ts.map