import type { RequestHandler } from '@sveltejs/kit';
import type { AuthDeps } from '../deps.js';
/**
 * The TOTP two-factor route group — one bundled factory (the package's
 * multi-route convention). Mount the groups on the paths the client components
 * call (`<TwoFactorManager>` talks to `setup`/`enable`/`disable` under its
 * `apiPath`, default `/api/auth/account/2fa`; the auth store's login flow
 * posts to `verify`):
 *
 * ```ts
 * const twoFactor = createTwoFactorHandlers(deps);
 * // …/2fa/setup/+server.ts   → export const POST = twoFactor.setup.POST;
 * // …/2fa/enable/+server.ts  → export const POST = twoFactor.enable.POST;
 * // …/2fa/disable/+server.ts → export const POST = twoFactor.disable.POST;
 * // …/2fa/verify/+server.ts  → export const POST = twoFactor.verify.POST;
 * ```
 *
 * - `setup` (authenticated) — begin enrolment: stage an **encrypted** secret
 *   (2FA not yet active) and return the `otpauth://` URI + Base32 secret.
 *   Refuses when already enabled, so a hijacked session can't silently
 *   re-enrol a new device.
 * - `enable` (authenticated) — `{ code }` proves possession against the staged
 *   secret, flips `totpEnabled` on and returns the backup codes (**once**, in
 *   plaintext). The old code set is cleared first.
 * - `disable` (authenticated, re-auth) — `{ currentPassword }` gates turning
 *   2FA off; clears the secret + every backup code. Rate-limited by default
 *   (`rateLimit.twoFactorDisable`) — success removes the second factor.
 * - `verify` (UNauthenticated) — the second login step: reads the short-lived
 *   pending-2FA cookie set by the login handler, accepts a TOTP **or** backup
 *   code, and establishes the real session. Strictly rate-limited.
 */
export declare function createTwoFactorHandlers<R extends string>(deps: AuthDeps<R>): {
    setup: {
        POST: RequestHandler;
    };
    enable: {
        POST: RequestHandler;
    };
    disable: {
        POST: RequestHandler;
    };
    verify: {
        POST: RequestHandler;
    };
};