import { type TOTPService } from '../../auth/mfa/totp.js';
import { MfaStore } from './mfa-store.js';
import { type MfaServiceConfig, type MfaEnrollmentResponse, type MfaEnrollmentCompleteResponse, type MfaStatusResponse, type MfaChallengeResponse, type MfaVerifyResponse, type MfaBackupCodesResponse } from './types.js';
import { SecurityAuditLogger } from '../../audit/security-logger.js';
/**
 * Base MFA error
 */
export declare class MfaError extends Error {
    code: string;
    constructor(message: string, code: string);
}
/**
 * Error when enrollment has expired
 */
export declare class EnrollmentExpiredError extends MfaError {
    constructor();
}
/**
 * Error when challenge has expired
 */
export declare class ChallengeExpiredError extends MfaError {
    constructor();
}
/**
 * Error when too many attempts have been made
 */
export declare class TooManyAttemptsError extends MfaError {
    constructor();
}
/**
 * MFA Service for managing multi-factor authentication
 */
export declare class MfaService {
    private readonly config;
    private readonly store;
    private readonly totpService;
    private readonly securityLogger;
    constructor(config?: Partial<MfaServiceConfig>, store?: MfaStore, totpService?: TOTPService, securityLogger?: SecurityAuditLogger);
    /**
     * Start MFA enrollment for a user
     *
     * Generates a new TOTP secret and QR code for authenticator app setup.
     * The enrollment must be verified and completed within the enrollment period.
     */
    enrollUser(userId: string, tenantId: string, email: string): Promise<MfaEnrollmentResponse>;
    /**
     * Verify TOTP code during enrollment
     *
     * Validates that the user has correctly configured their authenticator app.
     */
    verifyEnrollment(userId: string, tenantId: string, code: string): Promise<boolean>;
    /**
     * Complete MFA enrollment
     *
     * Activates MFA and generates backup codes for account recovery.
     */
    completeEnrollment(userId: string, tenantId: string): Promise<MfaEnrollmentCompleteResponse>;
    /**
     * Create an MFA challenge for login verification
     */
    createChallenge(userId: string, sessionId: string, tenantId?: string): Promise<MfaChallengeResponse>;
    /**
     * Verify an MFA challenge with TOTP code or backup code
     */
    verifyChallenge(challengeToken: string, code: string, tenantId: string, clientIp?: string): Promise<MfaVerifyResponse>;
    /**
     * Verify a backup code
     */
    private verifyBackupCode;
    /**
     * Regenerate backup codes
     */
    regenerateBackupCodes(userId: string, tenantId: string): Promise<MfaBackupCodesResponse>;
    /**
     * Get MFA status for a user
     */
    getMfaStatus(userId: string, tenantId: string): Promise<MfaStatusResponse>;
    /**
     * Disable MFA for a user
     */
    disableMfa(userId: string, tenantId: string, reason?: string): Promise<void>;
    /**
     * Check if user needs to complete MFA
     */
    requiresMfa(userId: string, tenantId: string, sessionId: string): Promise<boolean>;
    /**
     * Decrypt TOTP secret from storage
     */
    private decryptSecret;
    /**
     * Timing-safe string comparison
     */
    private timingSafeCompare;
}
/**
 * Get the singleton MFA service instance
 */
export declare function getMfaService(config?: Partial<MfaServiceConfig>): MfaService;
/**
 * Reset the singleton instance (for testing)
 */
export declare function resetMfaService(): void;
/**
 * Create a new MFA service with custom dependencies (for testing)
 */
export declare function createMfaService(config?: Partial<MfaServiceConfig>, store?: MfaStore, totpService?: TOTPService, securityLogger?: SecurityAuditLogger): MfaService;
//# sourceMappingURL=mfa-service.d.ts.map