export type MfaStatus = 'loading' | 'enabled' | 'disabled' | 'error';
export interface MfaEnrollment {
    /** otpauth:// URI to render as a QR code. */
    uri: string;
    /** Base32 secret for manual entry when a camera isn't available. */
    secret: string;
    /** One-time recovery codes — shown once, never retrievable again. */
    backupCodes: string[];
}
interface ActionResult {
    ok: boolean;
    error?: string;
}
/**
 * Drives the per-user MFA (TOTP) enrollment loop against the real auth API:
 *   1. `beginSetup(password)` — password reauth → POST /auth/totp/setup, which
 *      returns the provisioning URI + one-time backup codes.
 *   2. `confirmSetup(code)`   — POST /auth/totp/verify to flip totpEnabled on.
 *   3. `disable(password)`    — password reauth → POST /auth/totp/disable.
 *
 * The hook never holds the user's password and never persists the secret or
 * backup codes beyond the in-memory enrollment object (cleared on cancel/finish).
 */
export declare function useMfaEnrollment(): {
    status: MfaStatus;
    enrollment: MfaEnrollment | null;
    busy: boolean;
    refresh: () => Promise<void>;
    beginSetup: (password: string) => Promise<ActionResult>;
    confirmSetup: (code: string) => Promise<ActionResult>;
    cancelSetup: () => void;
    disable: (password: string) => Promise<ActionResult>;
};
export {};
//# sourceMappingURL=useMfaEnrollment.d.ts.map