import type { ControlPlaneStore } from '../control-plane/store';
import type { JsonValue } from '../control-plane/types';
import type { AuthActionToken, AuthActionTokenType, AuthenticationStoreOptions, AuthIdentity, AuthMfaChallenge, AuthMfaFactor, AuthOidcProvider, AuthOidcSubject, AuthOidcTransaction, AuthSession, CreateAuthIdentityInput, CreateAuthSessionInput, UpsertAuthOidcProviderInput } from './types';
export declare const AUTH_SESSION_IDLE_TTL_MS: number;
export declare const AUTH_SESSION_ABSOLUTE_TTL_MS: number;
export declare const AUTH_ACTION_TOKEN_TTL_MS: number;
export declare const AUTH_MFA_CHALLENGE_TTL_MS: number;
export declare const AUTH_OIDC_TRANSACTION_TTL_MS: number;
export declare class AuthenticationStore {
    private readonly controlPlane;
    private readonly nowFn;
    private readonly idFn;
    private readonly encryptionKey?;
    constructor(controlPlane: ControlPlaneStore, options?: AuthenticationStoreOptions);
    private now;
    private run;
    private encrypt;
    private decrypt;
    createIdentity(input: CreateAuthIdentityInput): AuthIdentity;
    getIdentity(id: string): AuthIdentity | undefined;
    getIdentityByActor(actorId: string): AuthIdentity | undefined;
    getIdentityByUsername(username: string): AuthIdentity | undefined;
    getIdentityByEmail(email: string): AuthIdentity | undefined;
    listIdentities(): AuthIdentity[];
    updatePassword(identityId: string, passwordHash: string, options?: {
        requiresUpgrade?: boolean;
        revokeSessions?: boolean;
    }): AuthIdentity;
    /** Upgrade password-hash parameters without treating it as a credential change. */
    rehashPassword(identityId: string, passwordHash: string): AuthIdentity;
    setVerifiedEmail(identityId: string, email: string): AuthIdentity;
    recordLogin(identityId: string): AuthIdentity;
    setDisabled(identityId: string, disabled: boolean): AuthIdentity;
    createActionToken(identityId: string, type: AuthActionTokenType, options?: {
        ttlMs?: number;
        metadata?: JsonValue;
    }): {
        actionToken: AuthActionToken;
        token: string;
    };
    getActionToken(id: string): AuthActionToken | undefined;
    consumeActionToken(token: string, type: AuthActionTokenType): AuthActionToken;
    revokeActionTokens(identityId: string, type: AuthActionTokenType): number;
    createSession(input: CreateAuthSessionInput): {
        session: AuthSession;
        token: string;
    };
    getSession(id: string): AuthSession | undefined;
    verifySessionToken(token: string): {
        identity: AuthIdentity;
        session: AuthSession;
    } | undefined;
    listSessions(identityId: string, options?: {
        includeInactive?: boolean;
    }): AuthSession[];
    revokeSession(identityId: string, sessionId: string): boolean;
    revokeOtherSessions(identityId: string, currentSessionId: string): number;
    getMfaFactor(identityId: string): AuthMfaFactor | undefined;
    beginTotpEnrollment(identityId: string, options?: {
        label?: string;
        issuer?: string;
    }): {
        factor: AuthMfaFactor;
        secret: string;
        uri: string;
    };
    verifyTotpEnrollment(identityId: string, code: string): {
        factor: AuthMfaFactor;
        recoveryCodes: string[];
    };
    verifyMfaCode(identityId: string, code: string, options?: {
        consumeRecovery?: boolean;
    }): {
        valid: boolean;
        method?: 'totp' | 'recovery';
    };
    remainingRecoveryCodes(identityId: string): number;
    disableMfa(identityId: string): void;
    createMfaChallenge(identityId: string, purpose: AuthMfaChallenge['purpose']): {
        challenge: AuthMfaChallenge;
        token: string;
    };
    getMfaChallenge(id: string): AuthMfaChallenge | undefined;
    inspectMfaChallengeToken(token: string, purpose: AuthMfaChallenge['purpose']): AuthMfaChallenge | undefined;
    completeMfaChallenge(token: string, code: string, purpose: AuthMfaChallenge['purpose']): {
        identity: AuthIdentity;
        challenge: AuthMfaChallenge;
        method: 'totp' | 'recovery';
    };
    markSessionStepUp(sessionId: string, mfa?: boolean): AuthSession;
    isRecentlyAuthenticated(session: AuthSession, maxAgeMs?: number): boolean;
    upsertOidcProvider(input: UpsertAuthOidcProviderInput): AuthOidcProvider;
    getOidcProvider(id: string): AuthOidcProvider | undefined;
    getOidcProviderBySlug(slug: string): AuthOidcProvider | undefined;
    listOidcProviders(organizationId?: string, options?: {
        includeDisabled?: boolean;
    }): AuthOidcProvider[];
    setOidcProviderEnabled(providerId: string, enabled: boolean): AuthOidcProvider;
    getOidcProviderCredentials(providerId: string): {
        provider: AuthOidcProvider;
        clientSecret: string;
    };
    beginOidcTransaction(providerId: string, redirectUri: string, returnPath: string): {
        transaction: AuthOidcTransaction;
        state: string;
        nonce: string;
        verifier: string;
    };
    getOidcTransaction(id: string): AuthOidcTransaction | undefined;
    consumeOidcTransaction(providerId: string, state: string): {
        transaction: AuthOidcTransaction;
        nonce: string;
        verifier: string;
    };
    getOidcSubject(providerId: string, subject: string): AuthOidcSubject | undefined;
    linkOidcSubject(providerId: string, identityId: string, subject: string, email: string): AuthOidcSubject;
    purgeExpired(): {
        actionTokens: number;
        sessions: number;
    };
}
