import { UpdateMultiFactorInfoRequest, UserRecord } from 'firebase-admin/auth';
import { MultiFactorConstructor, MultiFactorIdentifier, MultiFactorSelector } from '../types.js';
import { AuthInstance, IMultiFactorInfo } from './auth-types.js';
type WithToJSON<T> = T & {
    toJSON(): object;
};
/**
 * Determines whether a UID is valid according to Firebase Auth constraints.
 *
 * @remarks
 * A UID is considered valid when:
 * - It is a non-empty string
 * - Its length is at most 128 characters
 *
 * This mirrors the core UID validation used by Firebase Authentication.
 *
 * @param uid - UID to test for validity.
 * @returns `true` if the UID is valid; otherwise, `false`.
 */
export declare function isValidUid(uid: string | null | undefined): boolean;
/**
 * Validates and normalizes custom claims for a user.
 *
 * @remarks
 * This helper enforces several constraints on custom claims to mirror
 * Firebase Authentication behavior:
 *
 * - Rejects any claim whose key is listed in {@link FORBIDDEN_CUSTOM_CLAIMS}
 *   using the `auth/invalid-claims` error code.
 * - Ensures that the claims object is JSON-serializable.
 * - Enforces a maximum serialized size of 1000 characters, otherwise throws
 *   `auth/claims-too-large`.
 *
 * On success, a deep-cloned copy of the claims object is returned to prevent
 * accidental mutation of the original input.
 *
 * @param claims - Raw custom claims object supplied by the caller.
 * @returns A deep-cloned, validated claims object, or `undefined` if the input
 * is falsy.
 * @throws {@link FirebaseError} with codes `auth/invalid-claims` or
 * `auth/claims-too-large` when validation fails.
 */
export declare function validatedCustomClaims(claims: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
/**
 * Tests whether a given custom-claim key is reserved/forbidden.
 *
 * @param key - Claim key to inspect.
 * @returns `true` if the key is reserved and must not be used in custom
 * claims; otherwise, `false`.
 */
export declare function isForbiddenCustomClaim(key: string): boolean;
/**
 * Generates a synthetic email address for test identities.
 *
 * @remarks
 * The local-part is randomized via a 6-hex ID. The domain defaults to
 * `"example.com"` when not explicitly provided.
 *
 * @param domain - Optional domain to use in the generated email.
 * @returns A realistic email address (for example, `"user-a1b2c3@example.com"`).
 */
export declare function generateEmail(domain?: string): string;
/**
 * Generates a synthetic E.164-style phone number for test identities.
 *
 * @remarks
 * The generated value follows the pattern:
 * `+<country or 1>555<7 digit random number>`.
 *
 * @param country - Optional country code (numeric). Defaults to `1` (US/Canada).
 * @returns A phone number string in a plausible E.164 format.
 */
export declare function generatePhoneNumber(country?: number): string;
/**
 * Attaches a `toJSON()` method to a value that returns a deep copy of the value.
 *
 * @remarks
 * Some Firebase Admin SDK classes (for example, {@link UserRecord}) expose
 * data primarily via `toJSON()`. When building mock equivalents, this helper
 * ensures the same behavior is available by:
 *
 * - Assigning a `toJSON` function that returns a deep clone of the object.
 * - Returning the value with the added `toJSON` method typed as {@link WithToJSON}.
 *
 * @typeParam T - Type of the value to decorate.
 * @param value - Value to which a `toJSON` method will be attached.
 * @returns The same value, now typed as {@link WithToJSON}, with a `toJSON()`
 * method returning a deep copy.
 */
export declare function withToJSON<T>(value: T): WithToJSON<T>;
/**
 * Recursively applies {@link withToJSON} to a value or array of values.
 *
 * @remarks
 * - If `target` is `undefined` or `null`, nothing is done.
 * - If `target` is an array, each element is decorated with `toJSON()`.
 * - Otherwise, the single value is decorated in-place.
 *
 * This is especially useful for collections such as `providerData` or
 * `multiFactor.enrolledFactors` that are expected to support `toJSON()`
 * in the Admin SDK.
 *
 * @typeParam T - Type of the target value(s).
 * @param target - A single value or array of values to decorate.
 */
export declare function applyToJSON<T>(target: T | T[] | undefined): void;
/**
 * Predicate used to select matching {@link AuthInstance} entries.
 *
 * @remarks
 * This is used throughout the mock to implement lookup helpers that
 * search the in-memory auth store by arbitrary conditions.
 */
export type AuthInstancePredicate = (ai: AuthInstance) => boolean;
/**
 * Finds the first user record in a store that matches a predicate.
 *
 * @remarks
 * - Iterates over all {@link AuthInstance} values in the store.
 * - Returns the first match converted to a {@link UserRecord} via
 *   {@link toUserRecord}.
 *
 * @param store - A map of UID to {@link AuthInstance}.
 * @param predicate - Predicate used to test each entry.
 * @returns The first matching {@link UserRecord}, or `undefined` if no match
 * is found.
 */
export declare function findUserRecord(store: Map<string, AuthInstance>, predicate: AuthInstancePredicate): UserRecord | undefined;
/**
 * Retrieves a user record from the store by UID.
 *
 * @param uid - UID of the user to look up.
 * @param store - Map of UID to {@link AuthInstance}.
 * @returns The corresponding {@link UserRecord}, or `undefined` if the user
 * does not exist.
 */
export declare function getUserRecord(uid: string, store: Map<string, AuthInstance>): UserRecord | undefined;
/**
 * Converts an internal {@link AuthInstance} into a public {@link UserRecord}.
 *
 * @remarks
 * This function:
 *
 * - Deep clones and attaches `toJSON()` to metadata and provider data.
 * - Normalizes `emailVerified` to a boolean.
 * - Populates multi-factor enrollments on `userRecord.multiFactor.enrolledFactors`.
 * - Copies custom claims to `userRecord.customClaims` when present.
 * - Assigns core fields (email, displayName, photoURL, phoneNumber, etc.)
 *   using {@link assignIf} for optionality.
 *
 * The resulting object is cast to {@link UserRecord} but is backed by a
 * {@link IUserRecord} (mock-friendly mutable data type).
 *
 * @param ai - The internal auth instance to transform.
 * @returns A {@link UserRecord} mirroring what the Admin SDK would return.
 */
export declare function toUserRecord(ai: AuthInstance): UserRecord;
/**
 * Resolves a specific second-factor enrollment from an {@link AuthInstance}.
 *
 * @remarks
 * Resolution logic:
 *
 * 1. If `ai.multiFactorInfo` is empty or undefined → returns `undefined`.
 * 2. If `secondFactor` is not supplied, falls back to `ai.multiFactorDefault`.
 * 3. If still undefined, `undefined` is returned.
 * 4. If `secondFactor` is a string, it is treated as a `factorId`.
 * 5. If `secondFactor.uid` is present, matching is done by UID.
 * 6. Otherwise, if `secondFactor.factorId` is present, matching is done
 *    by factorId.
 *
 * A deep clone of the resolved {@link IMultiFactorInfo} is returned so
 * that callers may modify the result safely.
 *
 * @param ai - Auth instance containing multi-factor enrollments.
 * @param secondFactor - Selector specifying which enrollment to resolve.
 * @returns A cloned {@link IMultiFactorInfo} for the matching factor, or
 * `undefined` if no appropriate enrollment is found.
 */
export declare function resolveSecondFactor(ai: AuthInstance, secondFactor: MultiFactorIdentifier | MultiFactorSelector | undefined): IMultiFactorInfo | undefined;
/**
 * Populates an {@link AuthInstance}'s multi-factor enrollments.
 *
 * @remarks
 * This function normalizes the different multi-factor request shapes to the
 * internal {@link IMultiFactorInfo} representation:
 *
 * - Creates new factor entries for each item in `enrollments`.
 * - Generates a synthetic UID when one is not provided.
 * - For `factorId === 'phone'`, copies `phoneNumber` from
 *   {@link PhoneMultiFactorContructor}.
 * - Normalizes `enrollmentTime` using {@link utcDate}.
 *
 * Existing enrollments on `ai.multiFactorInfo` are preserved; new factors
 * are appended.
 *
 * @param ai - The auth instance to mutate.
 * @param enrollments - One or more multi-factor enrollment definitions,
 * or `null`/`undefined` to do nothing.
 */
export declare function assignMultiFactors(ai: AuthInstance, enrollments: MultiFactorConstructor[] | UpdateMultiFactorInfoRequest[] | null | undefined): void;
/**
 * Generates a synthetic, base64-like password hash for tests.
 *
 * @remarks
 * The supplied `password` is intentionally ignored; the returned hash is
 * a random 64-character base64-like string generated by {@link base64LikeId}.
 * This is sufficient for tests that only require a non-empty hash value.
 *
 * @param password - Ignored; present for API shape compatibility.
 * @returns A random 64-character base64-like string.
 */
export declare function base64PasswordHash(password: string): string;
/**
 * Generates a synthetic, base64-like password salt for tests.
 *
 * @remarks
 * The returned value is a random 16-character base64-like string generated
 * by {@link base64LikeId}.
 *
 * @returns A random 16-character base64-like string.
 */
export declare function base64PasswordSalt(): string;
export {};
//# sourceMappingURL=auth-helpers.d.ts.map