/**
 * Turnkey Email Authentication Service
 * Implements email-based authentication using Turnkey's OTP flow
 */
import { Turnkey } from '@turnkey/sdk-server';
import type { EmailAuthSession, InitiateAuthResult, VerifyAuthResult } from '../types.js';
/**
 * Session storage interface for pluggable session management
 */
export interface SessionStorage {
    get(sessionId: string): EmailAuthSession | undefined;
    set(sessionId: string, session: EmailAuthSession): void;
    delete(sessionId: string): void;
    cleanup(): void;
}
/**
 * Create an in-memory session storage.
 *
 * **Production warning**: This store is ephemeral — sessions are lost on
 * process restart and are not shared across multiple instances. For
 * production deployments, pass a persistent {@link SessionStorage}
 * implementation backed by Redis, a database, or another shared store.
 */
export declare function createInMemorySessionStorage(): SessionStorage;
/**
 * Initiate email authentication using Turnkey OTP
 * Sends a 6-digit OTP code to the user's email
 *
 * No Turnkey resources are provisioned here: the sub-organization (and its
 * wallet) is only created in {@link verifyEmailAuth}, after the caller has
 * proven control of the email address by presenting a valid OTP code.
 *
 * **Rate limiting is the caller's responsibility.** This function sends an
 * email on every call. Endpoints exposing it MUST enforce rate limits (per
 * IP and per target email) to prevent OTP email bombing of arbitrary
 * inboxes; Turnkey's per-`userIdentifier` throttle does not protect
 * arbitrary recipient addresses from an attacker who varies the email.
 */
export declare function initiateEmailAuth(email: string, turnkeyClient: Turnkey, sessionStorage?: SessionStorage): Promise<InitiateAuthResult>;
/**
 * Options for {@link verifyEmailAuth}.
 */
export interface VerifyEmailAuthOptions {
    /**
     * Compressed P-256 public key (hex) supplied by the client, to which the
     * Turnkey verification token will be bound. When provided, the matching
     * private key never leaves the client: the verify result contains no
     * `privateKey`, so nothing sensitive transits the HTTP response.
     *
     * When omitted, an ephemeral keypair is generated server-side and its
     * private key is returned in the result. This is a fallback for
     * server-only flows — for browser clients, always generate the keypair in
     * the browser and pass its public key here.
     */
    publicKey?: string;
    /**
     * Override for the enclave signing key used to verify the OTP encryption
     * target bundle's signature before encrypting the OTP code. ONLY for tests
     * or non-production Turnkey environments; defaults to Turnkey's production
     * signer key.
     */
    dangerouslyOverrideSignerPublicKey?: string;
}
/**
 * Verify email authentication code using Turnkey OTP
 *
 * Implements the Turnkey v6 encrypted-bundle flow: the OTP code is encrypted
 * to the `otpEncryptionTargetBundle` captured during {@link initiateEmailAuth}
 * and submitted as `encryptedOtpBundle` to Turnkey's `verifyOtp` activity.
 *
 * On success this also provisions the user's Turnkey sub-organization (get
 * or create) — deferred from initiation so that resources are only created
 * for proven email addresses.
 *
 * Returns the `verificationToken` together with the public key it is bound
 * to. When no client `publicKey` was supplied (see
 * {@link VerifyEmailAuthOptions}), the server-generated ephemeral private
 * key is also returned, which the caller needs to complete a subsequent
 * `otpLogin`.
 *
 * Failed verification attempts are counted per session; after
 * {@link MAX_OTP_ATTEMPTS} failures the session is destroyed and the user
 * must request a new code.
 */
export declare function verifyEmailAuth(sessionId: string, code: string, turnkeyClient: Turnkey, sessionStorage?: SessionStorage, options?: VerifyEmailAuthOptions): Promise<VerifyAuthResult>;
/**
 * Check if a session is verified
 */
export declare function isSessionVerified(sessionId: string, sessionStorage?: SessionStorage): boolean;
/**
 * Clean up a session after successful login
 */
export declare function cleanupSession(sessionId: string, sessionStorage?: SessionStorage): void;
/**
 * Get session data
 *
 * Note: `subOrgId` is only present on sessions that have completed
 * verification — initiation no longer provisions the sub-organization.
 */
export declare function getSession(sessionId: string, sessionStorage?: SessionStorage): EmailAuthSession | undefined;
//# sourceMappingURL=email-auth.d.ts.map