export interface ValidationError {
    field: string;
    message: string;
}
export type ValidationResult<T> = {
    success: true;
    data: T;
    errors?: undefined;
} | {
    success: false;
    data?: undefined;
    errors: ValidationError[];
};
/**
 * Read and JSON-parse a request body without ever throwing. A malformed or
 * non-JSON body (wrong `Content-Type`, truncated payload, empty body, …) makes
 * `request.json()` throw a `SyntaxError`; left unhandled that surfaces as a 500
 * (and, depending on the adapter, a stack leak). Returning `{}` instead lets
 * the field validators below produce a clean, structured 400 — an attacker
 * can't turn a bad body into a server error. Mirrors the pattern the passkey
 * handlers already use inline.
 */
export declare function readJsonBody(request: {
    json(): Promise<unknown>;
}): Promise<unknown>;
export declare function validateLoginInput(body: unknown): ValidationResult<{
    email: string;
    password: string;
}>;
export declare function validateRegisterInput(body: unknown): ValidationResult<{
    email: string;
    name: string;
    password: string;
    token: string;
}>;
export declare function validateEmailInput(body: unknown): ValidationResult<{
    email: string;
}>;
export declare function validateTokenInput(body: unknown): ValidationResult<{
    token: string;
}>;
export declare function validateResetPasswordInput(body: unknown): ValidationResult<{
    token: string;
    password: string;
}>;
export declare function validateChangePasswordInput(body: unknown): ValidationResult<{
    currentPassword: string;
    newPassword: string;
}>;
export declare function validateChangeEmailInput(body: unknown): ValidationResult<{
    newEmail: string;
    currentPassword: string;
}>;
export declare function validateUpdateProfileInput(body: unknown): ValidationResult<{
    name: string;
}>;
/** The label a user gives one passkey — {@link validateDisplayName}'s rule. */
export declare function validatePasskeyNameInput(body: unknown): ValidationResult<{
    name: string;
}>;
export declare function validateDeleteAccountInput(body: unknown): ValidationResult<{
    currentPassword: string;
}>;
/**
 * Validate a 2FA code submission (the `enable` and `verify` steps). The field is
 * a non-empty, length-bounded string — it may be a 6-digit TOTP code **or** a
 * formatted backup code, so the strict "6 digits" shape is intentionally NOT
 * enforced here; `verifyTotp` rejects a non-numeric/short TOTP and the backup
 * path hashes whatever is left. The bound just keeps unbounded input out of the
 * verify path.
 */
export declare function validateTotpInput(body: unknown): ValidationResult<{
    code: string;
}>;
/**
 * Validate the disable-2FA submission. Re-auth is by current password (the
 * shared `verifyCurrentPassword` building block) — same shape as
 * delete-account — so turning the second factor off requires a fresh credential
 * confirmation, not just a live session.
 */
export declare function validateDisable2faInput(body: unknown): ValidationResult<{
    currentPassword: string;
}>;
export declare function validateInvitationInput(body: unknown, allowedRoles: readonly string[]): ValidationResult<{
    email: string;
    role: string;
    sendEmail: boolean;
}>;