import { SmrtClassOptions } from '@happyvertical/smrt-core';
/**
 * Options for MagicLinkService
 */
export interface MagicLinkServiceOptions extends SmrtClassOptions {
    /** Secret used to derive the HMAC signing key (required) */
    secret: string;
    /** Token expiry in seconds (default: 10 minutes) */
    tokenExpiry?: number;
    /** JWT issuer claim (default: 'smrt:magiclink') */
    issuer?: string;
}
/**
 * Result of generating a magic link token
 */
export interface MagicLinkResult {
    /** The signed JWT token */
    token: string;
    /** When the token expires */
    expiresAt: Date;
}
/**
 * Result of verifying a magic link token
 */
export interface MagicLinkVerifyResult {
    /** The email address from the token */
    email: string;
    /** The nonce (for correlation/logging) */
    nonce: string;
}
/**
 * Error class for magic link authentication failures
 */
export declare class MagicLinkError extends Error {
    constructor(message: string);
}
/**
 * MagicLinkService provides passwordless authentication via email magic links.
 *
 * Tokens are HMAC-signed JWTs with embedded nonces for replay protection.
 * The service is framework-agnostic — it does not send emails or set cookies.
 */
export declare class MagicLinkService {
    private tokenCollection;
    private signingKey;
    private readonly secret;
    private readonly tokenExpiry;
    private readonly issuer;
    private readonly options;
    constructor(options: MagicLinkServiceOptions);
    /**
     * Initialize collections
     */
    initialize(): Promise<void>;
    /**
     * Derive the HMAC signing key from the secret
     */
    private getSigningKey;
    /**
     * Generate a magic link token for the given email.
     *
     * Stores a nonce in the database for replay protection.
     * The caller is responsible for emailing the token to the user.
     */
    generate(email: string): Promise<MagicLinkResult>;
    /**
     * Verify a magic link token.
     *
     * Checks JWT signature, expiry, and that the nonce hasn't been used.
     * Marks the nonce as used on success (single-use enforcement).
     *
     * @throws {MagicLinkError} If the token is invalid, expired, or already used
     */
    verify(token: string): Promise<MagicLinkVerifyResult>;
    /**
     * Clean up expired tokens (run periodically)
     */
    cleanupExpiredTokens(): Promise<number>;
    /**
     * Static factory method
     */
    static create(options: MagicLinkServiceOptions): Promise<MagicLinkService>;
}
//# sourceMappingURL=MagicLinkService.d.ts.map