import type { AuthUserRecord } from "../contracts/authUserDirectory";
type PasswordLoginFailure = "mfa_required" | "mfa_invalid";
type PasswordLoginSuccess = {
    ok: true;
    consumedRecoveryHash?: string;
};
type PasswordLoginDenied = {
    ok: false;
    error: PasswordLoginFailure;
};
type PasswordLoginResult = PasswordLoginSuccess | PasswordLoginDenied;
declare function parseRecoveryHashes(raw: string | null | undefined): string[];
declare function completePasswordLogin(user: Pick<AuthUserRecord, "mfa_enabled" | "mfa_secret" | "mfa_recovery_codes">, options?: {
    mfaCode?: string | null;
}): PasswordLoginResult;
declare function persistConsumedRecoveryHash(sql: {
    unsafe(query: string, params?: readonly unknown[]): Promise<unknown[]>;
}, userId: number, currentRaw: string | null | undefined, consumedHash: string | undefined): Promise<void>;
export type { PasswordLoginResult };
export { completePasswordLogin, parseRecoveryHashes, persistConsumedRecoveryHash };