/**
 * Short-TTL one-time exchange codes for mobile QR login.
 *
 * CR P2c — QR landing URLs used to embed the raw access token in
 * `?t=…` (browser history, Referer, OS screenshot OCR, shared logs).
 * Instead we mint a random code that maps to the raw token for a few
 * minutes and is consumed on first successful exchange.
 *
 * Storage is process-local Map (+ optional disk mirror under AGIM_HOME
 * so a soft restart within TTL can still redeem). Not a durable auth
 * store — revoke the underlying token via /settings/security/tokens.
 */
/** Mint a one-time code for the given raw token. */
export declare function issueMobileQrExchange(raw: string, tokenId: string, ttlMs?: number): {
    code: string;
    expiresAt: number;
};
/** Consume a code (one-shot). Returns null if missing/expired. */
export declare function consumeMobileQrExchange(code: string): {
    raw: string;
    tokenId: string;
} | null;
/** Test helper — clear in-memory + disk state. */
export declare function __resetMobileQrExchangeForTesting(): void;
/** Test helper — mark a code expired without waiting for TTL. */
export declare function __expireMobileQrExchangeForTesting(code: string): void;
//# sourceMappingURL=mobile-qr-exchange.d.ts.map