import type { Guard } from './http';
import { Session } from './session';
/** Who is acting as whom during impersonation. */
export interface Impersonation {
    /** The real actor (e.g. an admin's id). */
    actor: string;
    /** The user being impersonated. */
    target: string;
}
/**
 * Mark the current session as freshly re-authenticated (a "step up") — call
 * right after the user re-enters a password or completes MFA for a sensitive
 * action. Requires the `session()` plugin.
 *
 * @param session - The session to mark as elevated.
 * @param at - Epoch-ms timestamp of the re-authentication (default now).
 */
export declare function elevate(session: Session, at?: number): void;
/**
 * Clear a session's step-up marker, so the next {@link requireStepUp} guard
 * fails until the user re-authenticates — e.g. call it once the sensitive action
 * completes to keep the elevation short-lived.
 *
 * @param session - The session to clear the step-up marker from.
 */
export declare function clearElevation(session: Session): void;
/**
 * Milliseconds since the session was last elevated, or `undefined` if never.
 *
 * @param session - The session to read the step-up marker from.
 * @param now - Epoch-ms timestamp to measure against (default now).
 * @returns Milliseconds since the last elevation, or `undefined` if never elevated.
 */
export declare function elevationAge(session: Session, now?: number): number | undefined;
/**
 * Guard: require the session to have been elevated within `within` ms, else
 * reply `401` — the way to gate a sensitive route behind recent re-authentication
 * (step-up). Pairs with {@link elevate} and the `session()` plugin.
 *
 * ```ts
 * @post('/settings/delete-account')
 * @use(requireStepUp({ within: 5 * 60_000 })) // re-auth within 5 minutes
 * deleteAccount() {}
 * ```
 *
 * @param options - Step-up requirements: `within` (max age in ms), plus optional `clock` and `status`.
 */
export declare function requireStepUp(options: {
    /** Maximum age of the step-up, in ms. */
    within: number;
    /** Clock source (default `Date.now`). */
    clock?: () => number;
    /** Status for a missing/stale step-up (default 401). */
    status?: number;
}): Guard;
/**
 * Begin impersonation: record that `actor` is acting as `target` on the current
 * session. Keep the actor's own identity for audit and reversal. Requires the
 * `session()` plugin.
 *
 * @param session - The session to record the impersonation on.
 * @param impersonation - Who is acting as whom (actor and target).
 */
export declare function impersonate(session: Session, impersonation: Impersonation): void;
/**
 * The active impersonation on a session, or `undefined`.
 *
 * @param session - The session to read the impersonation from.
 * @returns The active impersonation, or `undefined` if none.
 */
export declare function getImpersonation(session: Session): Impersonation | undefined;
/**
 * End impersonation, reverting to the actor's own identity.
 *
 * @param session - The session to end impersonation on.
 */
export declare function stopImpersonation(session: Session): void;
//# sourceMappingURL=step-up.d.ts.map