import { Kysely } from "kysely";
import { Database } from "../db";
/**
 * Soft-revoke every unrevoked refresh token owned by a session.
 *
 * One hop on the `(tenant_id, session_id)` index rather than resolving through
 * the login session, which only ever records the session's *originating*
 * authorization transaction and so misses tokens minted in later SSO
 * re-authorizations.
 *
 * `revoked_at_ts IS NULL` keeps this idempotent and concurrency-safe — a
 * second revocation cannot overwrite the audit timestamp written by the first.
 */
export declare function revokeBySession(db: Kysely<Database>): (tenant_id: string, session_id: string, revoked_at: string) => Promise<number>;