/**
 * Tunable scrypt cost parameters.
 *
 * @property {number} N - CPU/memory cost, a power of two (the primary difficulty
 *   lever). Memory per hash is approximately `128 * N * r` bytes.
 * @property {number} r - Block size.
 * @property {number} p - Parallelization factor.
 * @property {number} keyLength - Derived key length in bytes.
 */
export interface ScryptParams {
    N: number;
    r: number;
    p: number;
    keyLength: number;
}
/**
 * Default OWASP scrypt profile (ADR, PRD-9): `N=2^17, r=8, p=1, keyLength=32`.
 *
 * Memory per hash is about 128 MiB; runtime on a modern CPU is roughly 100-250 ms.
 * Callers may lower `N` (e.g. for test suites or constrained CPUs) via the
 * {@link hashPassword} options; the chosen parameters are recorded in the output, so
 * verification never needs to know the current defaults.
 */
export declare const DEFAULT_SCRYPT_PARAMS: Readonly<ScryptParams>;
/** Options accepted by {@link hashPassword}. */
export interface HashPasswordOptions {
    /**
     * Override the scrypt cost parameters. Any omitted field falls back to
     * {@link DEFAULT_SCRYPT_PARAMS}. Lower `N` to trade strength for speed.
     */
    params?: Partial<ScryptParams>;
}
/**
 * Hash a plaintext password for storage using scrypt.
 *
 * A fresh 16-byte salt is generated per call, so hashing the same password twice
 * yields different strings. The result is fully self-describing (see the module
 * docs) and safe to store in a single text column.
 *
 * @param {string} plain - The plaintext password to hash.
 * @param {HashPasswordOptions} [options] - Optional scrypt parameter overrides.
 * @returns {Promise<string>} The stored hash: `scrypt$1$<params>$<saltHex>$<hashHex>`.
 */
export declare function hashPassword(plain: string, options?: HashPasswordOptions): Promise<string>;
/**
 * Verify a plaintext password against a hash produced by {@link hashPassword}.
 *
 * The stored parameters and salt are read back from `stored`, the candidate is
 * re-derived with them, and the two keys are compared with `timingSafeEqual` to
 * avoid leaking information through comparison timing. Any structurally invalid or
 * non-scrypt `stored` value (empty string, wrong field count, unknown algorithm,
 * bad hex) yields `false` rather than throwing, so it is safe on an auth path.
 *
 * @param {string} plain - The candidate plaintext password.
 * @param {string} stored - The stored hash string to check against.
 * @returns {Promise<boolean>} `true` when the password matches, `false` otherwise.
 */
export declare function verifyPassword(plain: string, stored: string): Promise<boolean>;