import type { Cookies } from '@sveltejs/kit';
import type { AuthConfig, TwoFactorConfig } from '../types.js';
import { type TotpAlgorithm } from './totp.js';
/** Write the pending-2FA cookie (HttpOnly, SameSite=Strict, short-lived). */
export declare function setPending2faCookie<R extends string>(cookies: Cookies, token: string, config: AuthConfig<R>): void;
export declare function readPending2faCookie<R extends string>(cookies: Cookies, config: AuthConfig<R>): string | null;
export declare function clearPending2faCookie<R extends string>(cookies: Cookies, config: AuthConfig<R>): void;
/**
 * Mint the signed pending-2FA token issued after a correct password when the
 * account has 2FA on. Purpose-bound (`'2fa-pending'`) — `verifySessionToken`
 * rejects it in the primitive (its purpose is not `'session'`), so it can
 * never act as a session; the claim shape (`{ pending2fa: true, sub }`, no
 * email/role/tokenVersion) stays as defense in depth. Short-lived
 * (`twoFactor.pendingTokenTtl`, default 5 min). Signed with the existing
 * `jwt.secret`.
 */
export declare function createPending2faToken<R extends string>(userId: string, config: AuthConfig<R>): Promise<string>;
/**
 * Verify a pending-2FA token and return the user id, or `null` when it is
 * missing/expired/forged or not actually a pending-2FA token. The purpose
 * binding in `verifySignedToken` rejects any token minted for another purpose
 * (session tokens included); the strict `pending2fa === true` + string-`sub`
 * check stays on top as the domain-shape guard.
 */
export declare function verifyPending2faToken<R extends string>(token: string, config: AuthConfig<R>): Promise<string | null>;
export interface ResolvedTotpOptions {
    algorithm: TotpAlgorithm;
    digits: number;
    period: number;
    window: number;
}
/** Resolve the TOTP parameters from config, applying the RFC-6238 defaults. */
export declare function resolveTotpOptions(config: TwoFactorConfig): ResolvedTotpOptions;
/**
 * The issuer label embedded in the otpauth URI (what the authenticator app
 * shows as the account's provider). Defaults to the host of `appUrl`; falls back
 * to a stable literal if `appUrl` can't be parsed.
 */
export declare function resolveIssuer<R extends string>(config: AuthConfig<R>): string;
/** SHA-256 hash of a backup code (after normalisation). Stored, never the plaintext. */
export declare function hashBackupCode(code: string): string;
/**
 * Generate a fresh batch of backup codes. Returns the **plaintext** (shown to
 * the user exactly once) and their SHA-256 `hashes` (the only thing persisted).
 * Each code is 80 bits of entropy (10 random bytes → 16 Base32 chars), grouped
 * `XXXX-XXXX-XXXX-XXXX` for legibility — high enough that the SHA-256 hashes are
 * not offline-brute-forceable even on a DB leak.
 */
export declare function generateBackupCodes(count?: number): {
    plain: string[];
    hashes: string[];
};
export declare function resolveBackupCodeCount(config: TwoFactorConfig): number;