import { Effect } from 'effect';
import { VoidIfEmpty } from 'effect/Types';
import { YieldableError } from 'effect/Cause';

/**
 * Hash a password. Returns a self-describing string that
 * `verifyPassword` can re-parse without external config. Don't
 * truncate this string — the parameters are encoded inline.
 */
export declare const hashPassword: (plaintext: string) => Effect.Effect<string, PasswordEmptyError | PasswordHashError>;

/**
 * Does this stored hash use parameters weaker than the framework's
 * current cost? `true` means "re-hash on next successful verify". A
 * malformed hash also returns `true` (it should be replaced).
 */
export declare const needsRehash: (stored: string) => boolean;

declare interface ParsedHash {
    readonly N: number;
    readonly r: number;
    readonly p: number;
    readonly keyLen: number;
}

/** Parse the scrypt parameters out of a stored hash. Returns null when the
 *  string isn't a well-formed `scrypt$N$r$p$salt$derived`, or when its
 *  parameters exceed the derivation ceiling. */
export declare const parseScryptParams: (stored: string) => ParsedHash | null;

export declare class PasswordEmptyError extends PasswordEmptyError_base<{
    readonly message: string;
}> {
}

declare const PasswordEmptyError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
    readonly _tag: "PasswordEmptyError";
} & Readonly<A>;

export declare class PasswordHashError extends PasswordHashError_base<{
    readonly message: string;
    readonly cause: unknown;
}> {
}

declare const PasswordHashError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
    readonly _tag: "PasswordHashError";
} & Readonly<A>;

/**
 * Verify a plaintext password against a stored hash.
 *
 * Uses `timingSafeEqual` for the comparison so attackers can't
 * fingerprint correct prefixes via response-time analysis.
 *
 * Returns `Effect<boolean, never>` — parse errors or scrypt errors
 * collapse to `false` because surfacing them lets attackers
 * fingerprint malformed-vs-mismatched, which leaks structural info.
 */
export declare const verifyPassword: (plaintext: string, stored: string) => Effect.Effect<boolean>;

/**
 * Verify a password and, when it matches an under-cost hash, return a
 * freshly-minted replacement. The caller wires `rehash` into
 * `UserStore.updatePassword(userId, rehash)`. Never throws — parse /
 * scrypt failures collapse to `{ valid: false }`.
 */
export declare const verifyPasswordWithRehash: (plaintext: string, stored: string) => Effect.Effect<VerifyWithRehashResult>;

export declare interface VerifyWithRehashResult {
    /** Whether the password matched the stored hash. */
    readonly valid: boolean;
    /** A freshly-minted hash under the current cost, present ONLY when the
     *  password was valid AND the stored hash was below current cost. The
     *  caller persists it via `UserStore.updatePassword`. */
    readonly rehash?: string;
}

export { }