import type { RequestHandler } from '@sveltejs/kit';
import type { AuthDeps } from '../deps.js';
export interface LogoutHandlerOptions {
    /**
     * End **every** session of the account on logout, not just this browser's:
     * bump the user's `tokenVersion`, so the generation check `createAuthHandle`
     * runs on each request refuses every access token minted before it, and —
     * with `config.refreshToken` configured — revoke every refresh family, so
     * nothing can rotate back in.
     *
     * Without it, logout revokes the refresh token the cookie carries and clears
     * both cookies — which ends the session in *this* browser, while a copy of
     * the access JWT taken beforehand (a `curl` session, a shared machine) keeps
     * verifying until `jwt.expiresIn` elapses. Nothing about that token is stored
     * server-side, so nothing local can refuse it.
     *
     * The price is that both writes are per user, not per session. Another
     * device is signed out until someone signs in again: its API client keeps
     * sending the same stale access cookie until that expires (`accessTokenTtl`,
     * 15 minutes by default) and is then refused on its revoked refresh token
     * instead — `401` either way, one no-op family revoke per request until a
     * page navigation clears the cookie and sends it to the login. The guard
     * answers an API request without resolving, and SvelteKit writes a cookie a
     * hook staged only on the paths that resolve or redirect. Sign a
     * *specific* device out with `createSessionsHandlers`' `revoke` /
     * `revokeOthers` instead; that path leaves `tokenVersion` alone.
     *
     * Defaults to `false`: no write beyond this browser's own refresh token.
     */
    invalidateAccessTokens?: boolean;
}
/**
 * End the caller's session: revoke the refresh token their cookie carries
 * (when rotation is configured) and clear both cookies. It requires no valid
 * session — a request whose access token has already expired still answers
 * `{ success: true }` with the cookies dropped.
 *
 * What it cannot end is an access token that left the browser: pass
 * `{ invalidateAccessTokens: true }` to end every session of the account
 * instead, at the price of signing the user's other devices out. See
 * docs/AUTH.md → Logout.
 */
export declare function createLogoutHandler<R extends string>(deps: AuthDeps<R>, options?: LogoutHandlerOptions): {
    POST: RequestHandler;
};