/**
 * Short-lived "you have proven your password, now show your second factor" token.
 *
 * Returned by `/auth/login` instead of the raw `userId` when a user has TOTP
 * enabled. The client then submits this token together with the TOTP code to
 * `/auth/totp/login`; the endpoint verifies the token before checking the code.
 *
 * Without this gate, anyone who learns or guesses a userId can brute-force
 * the 6-digit TOTP space directly. The token also pins the IP and user-agent
 * fingerprint, making session smuggling between hosts noticeably harder.
 */
export interface MfaPendingPayload {
    userId: string;
    fingerprint: string;
}
export declare function createMfaPendingToken(payload: MfaPendingPayload, secret: string): Promise<string>;
export declare function verifyMfaPendingToken(token: string, secret: string): Promise<MfaPendingPayload>;
/**
 * Compute a stable fingerprint of the request (IP + user-agent). Used so the
 * MFA-pending token can only be redeemed from the same device that completed
 * the password step.
 */
export declare function computeRequestFingerprint(ip: string, userAgent: string | null): Promise<string>;
//# sourceMappingURL=mfa-pending.d.ts.map