import type { RequestHandler } from '@sveltejs/kit';
import type { AuthDeps } from '../deps.js';
/**
 * A user-facing summary of one active session (one refresh-token family). The
 * raw token hash is never exposed; `id` is the opaque, user-scoped family UUID
 * used to revoke the session.
 */
export interface SessionSummary {
    id: string;
    userAgent: string | null;
    ip: string | null;
    /** ISO timestamp of the live token in the family ≈ "last active". */
    lastActive: string;
    /** Whether this is the session making the current request. */
    current: boolean;
}
/**
 * The session-management route group behind `<SessionManager>` — one bundled
 * factory (the package's multi-route convention). Requires
 * `config.refreshToken` rotation (a session is a refresh-token family). Mount
 * the groups on the paths the client component calls (default base
 * `/api/auth/sessions`):
 *
 * ```ts
 * const sessions = createSessionsHandlers(deps);
 * // src/routes/api/auth/sessions/+server.ts               → export const GET = sessions.list.GET;
 * // src/routes/api/auth/sessions/revoke/+server.ts        → export const POST = sessions.revoke.POST;
 * // src/routes/api/auth/sessions/revoke-others/+server.ts → export const POST = sessions.revokeOthers.POST;
 * ```
 *
 * - `list` — the caller's active sessions, newest first; the current request's
 *   session is flagged `current: true`. Without rotation configured the
 *   response is an empty list with `available: false`.
 * - `revoke` — revoke one session by family id (from `params.id` or the body
 *   `{ id }`). Ownership-scoped: a foreign/guessed id returns 404 (IDOR
 *   defense). Revoking the current session is allowed (remote sign-out).
 * - `revokeOthers` — revoke every session except the current one.
 */
export declare function createSessionsHandlers<R extends string>(deps: AuthDeps<R>): {
    list: {
        GET: RequestHandler;
    };
    revoke: {
        POST: RequestHandler;
    };
    revokeOthers: {
        POST: RequestHandler;
    };
};