/**
 * Reads `two_factor_secret`/`two_factor_enabled` directly — these are
 * guarantee-ALTER columns (see ensureUsersAuthColumns), not part of
 * the User model's typed `attributes`, so callers query them the same
 * way email-verification.ts reads email_verified_at: raw db access,
 * not the ORM model.
 */
export declare function getTwoFactorState(userId: number): Promise<{ secret: string | null, enabled: boolean }>;
export declare function isTwoFactorEnabled(user: TwoFactorUser): boolean;
/**
 * Generate a new (unpersisted) secret + otpauth:// URI for setup.
 */
export declare function generateTwoFactorSetup(email: string, serviceName?: string): { secret: string, uri: string };
/**
 * Stash a freshly generated secret server-side while the user goes
 * scan/enter it into their authenticator app. Single pending secret
 * per user — generating a new one invalidates any prior unconfirmed
 * attempt, same delete-then-insert shape as storeWebAuthnChallenge.
 */
export declare function stashPendingTwoFactorSecret(userId: number, secret: string, ttlSeconds?: number): Promise<void>;
/**
 * Consume (delete-on-read) the pending secret stashed for a user, or
 * null if none exists / it expired.
 */
export declare function consumePendingTwoFactorSecret(userId: number): Promise<string | null>;
/**
 * Verify the setup code against the not-yet-persisted secret and, if
 * valid, persist it + flip `two_factor_enabled` on.
 */
export declare function enableTwoFactor(userId: number, secret: string, code: string): Promise<boolean>;
export declare function disableTwoFactor(userId: number): Promise<void>;
/**
 * Verify a live login/dashboard-reauth code against the user's
 * already-persisted secret.
 */
export declare function verifyTwoFactorLoginCode(userId: number, code: string): Promise<boolean>;
/**
 * Create a single-use, short-lived login challenge for a user whose
 * password just verified but who still needs to supply a TOTP code.
 * Mirrors storeWebAuthnChallenge's delete-then-insert shape, keyed by
 * an opaque random id instead of (user_id, purpose) since a user can
 * only have one login attempt in flight that matters here.
 */
export declare function createTwoFactorChallenge(userId: number, ttlSeconds?: number): Promise<string>;
/**
 * Consume (delete-on-read) a login challenge and return the user id it
 * was issued for, or null if missing/expired.
 */
export declare function consumeTwoFactorChallenge(challengeToken: string): Promise<number | null>;
export declare const TwoFactor: {
  isEnabled: unknown;
  getState: unknown;
  generateSetup: unknown;
  stashPendingSecret: unknown;
  consumePendingSecret: unknown;
  enable: unknown;
  disable: unknown;
  verifyLoginCode: unknown;
  createChallenge: unknown;
  consumeChallenge: unknown
};
export declare interface TwoFactorUser {
  id: number
  email?: string
  two_factor_secret?: string | null
  two_factor_enabled?: boolean | number | null
}