/**
 * JWT Token Revocation Service
 *
 * Uses Redis to maintain a blacklist of revoked tokens.
 * Tokens are stored with TTL matching their expiration time.
 *
 * @packageDocumentation
 */
export interface TokenRevocationService {
    revokeToken(jti: string, expiresAt: Date): Promise<void>;
    isRevoked(jti: string): Promise<boolean>;
    revokeAllForUser(userId: string, issuedBefore: Date): Promise<void>;
    isUserTokenRevoked(userId: string, issuedAt: Date): Promise<boolean>;
}
/**
 * Create a token revocation service instance
 */
export declare function createTokenRevocationService(): TokenRevocationService;
/**
 * Validate that a token has a JTI claim
 * Returns the jti if valid, or handles missing jti based on environment
 */
export declare function validateJti(payload: {
    jti?: string;
}, config: {
    env: string;
    jwt: {
        requireJti: boolean;
    };
}): {
    valid: boolean;
    jti?: string;
    error?: string;
};
/**
 * Record a token revocation audit event
 */
export declare function recordTokenRevocationAudit(tenantId: string, userId: string, eventType: 'token.revoked' | 'token.user_all_revoked', actor: {
    type: 'user' | 'service' | 'system';
    id: string;
    name?: string;
    ip?: string;
}, metadata?: Record<string, unknown>): Promise<void>;
//# sourceMappingURL=token-revocation.d.ts.map