/**
 * Auth Service - TOTP-based 2FA authentication
 *
 * Handles:
 * - TOTP secret generation and verification
 * - JWT session token management
 * - Auth config persistence (~/.nebula/auth.json)
 */
export declare const SHORT_SESSION_HOURS = 24;
export declare const LONG_SESSION_DAYS = 30;
export interface AuthConfig {
    totpSecret: string;
    jwtSecret: string;
    setupComplete: boolean;
    createdAt: number;
}
export interface JWTPayload {
    iat: number;
    exp: number;
    trusted: boolean;
}
export interface AuthStatus {
    configured: boolean;
    authenticated: boolean;
}
export interface VerifyResult {
    success: boolean;
    token?: string;
    error?: string;
}
export interface RateLimitCheck {
    allowed: boolean;
    /** Seconds until the oldest failure ages out (0 when allowed). */
    waitSeconds: number;
}
declare class AuthService {
    private config;
    private initialized;
    private failedAttempts;
    private disabled;
    /**
     * Disable authentication (for local/dev usage only)
     */
    disableAuth(): void;
    isAuthDisabled(): boolean;
    /**
     * Initialize the auth service
     * Returns true if setup is needed (first run)
     */
    initialize(): Promise<boolean>;
    /**
     * Generate a secure random JWT secret
     */
    private generateJWTSecret;
    /**
     * Save config to disk with secure permissions
     */
    private saveConfig;
    /**
     * Print QR code and manual key to terminal for initial setup
     */
    printSetupInstructions(): void;
    /**
     * Check if 2FA setup is complete
     */
    isSetupComplete(): boolean;
    /**
     * Rate-limit check shared by every login path. Drops failures older than
     * the window, then reports whether another attempt may proceed.
     */
    checkRateLimit(): RateLimitCheck;
    /** Record a failed login attempt; returns attempts left in this window. */
    recordFailedAttempt(): number;
    /** A successful login clears the failure bucket. */
    clearFailedAttempts(): void;
    /**
     * Verify a TOTP code and issue a JWT token.
     * `trustBrowser` defaults to the long (30-day) session; pass `false`
     * explicitly for the 24 h one.
     */
    verifyCode(code: string, trustBrowser?: boolean): VerifyResult;
    /**
     * Issue a new session JWT. Public so every verified credential (TOTP code,
     * passkey assertion) mints the identical token the middleware validates.
     */
    issueToken(trusted?: boolean): string;
    /**
     * Validate a JWT token
     * Returns the payload if valid, null if invalid
     */
    validateToken(token: string): JWTPayload | null;
    /**
     * Get auth status for a request
     */
    getAuthStatus(token?: string): AuthStatus;
    /**
     * Get the TOTP secret (for testing only)
     * @internal
     */
    _getTotpSecret(): string | null;
}
export declare const authService: AuthService;
export {};