import { type Database } from '../../common/db.js';
import type { UserMfaRecord, MfaBackupCodeRecord, MfaChallengeRecord, CreateUserMfaInput, CreateChallengeInput } from './types.js';
export declare const mfaMethodEnum: import("drizzle-orm/pg-core").PgEnum<["totp", "backup_codes"]>;
export declare const mfaStatusEnum: import("drizzle-orm/pg-core").PgEnum<["pending", "active", "disabled"]>;
export declare const userMfa: import("drizzle-orm/pg-core").PgTableWithColumns<{
    name: "user_mfa";
    schema: undefined;
    columns: {
        id: import("drizzle-orm/pg-core").PgColumn<{
            name: "id";
            tableName: "user_mfa";
            dataType: "string";
            columnType: "PgUUID";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: true;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        userId: import("drizzle-orm/pg-core").PgColumn<{
            name: "user_id";
            tableName: "user_mfa";
            dataType: "string";
            columnType: "PgUUID";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        tenantId: import("drizzle-orm/pg-core").PgColumn<{
            name: "tenant_id";
            tableName: "user_mfa";
            dataType: "string";
            columnType: "PgUUID";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        totpSecret: import("drizzle-orm/pg-core").PgColumn<{
            name: "totp_secret";
            tableName: "user_mfa";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        totpSecretEncrypted: import("drizzle-orm/pg-core").PgColumn<{
            name: "totp_secret_encrypted";
            tableName: "user_mfa";
            dataType: "boolean";
            columnType: "PgBoolean";
            data: boolean;
            driverParam: boolean;
            notNull: false;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        status: import("drizzle-orm/pg-core").PgColumn<{
            name: "status";
            tableName: "user_mfa";
            dataType: "string";
            columnType: "PgEnumColumn";
            data: "pending" | "active" | "disabled";
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: ["pending", "active", "disabled"];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        enabledAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "enabled_at";
            tableName: "user_mfa";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        enrollmentStartedAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "enrollment_started_at";
            tableName: "user_mfa";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        enrollmentExpiresAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "enrollment_expires_at";
            tableName: "user_mfa";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        gracePeriodEndsAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "grace_period_ends_at";
            tableName: "user_mfa";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        createdAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "created_at";
            tableName: "user_mfa";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "updated_at";
            tableName: "user_mfa";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
    };
    dialect: "pg";
}>;
export declare const mfaBackupCodes: import("drizzle-orm/pg-core").PgTableWithColumns<{
    name: "mfa_backup_codes";
    schema: undefined;
    columns: {
        id: import("drizzle-orm/pg-core").PgColumn<{
            name: "id";
            tableName: "mfa_backup_codes";
            dataType: "string";
            columnType: "PgUUID";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: true;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        userMfaId: import("drizzle-orm/pg-core").PgColumn<{
            name: "user_mfa_id";
            tableName: "mfa_backup_codes";
            dataType: "string";
            columnType: "PgUUID";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        codeHash: import("drizzle-orm/pg-core").PgColumn<{
            name: "code_hash";
            tableName: "mfa_backup_codes";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        usedAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "used_at";
            tableName: "mfa_backup_codes";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        usedFromIp: import("drizzle-orm/pg-core").PgColumn<{
            name: "used_from_ip";
            tableName: "mfa_backup_codes";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        createdAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "created_at";
            tableName: "mfa_backup_codes";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
    };
    dialect: "pg";
}>;
export declare const mfaChallenges: import("drizzle-orm/pg-core").PgTableWithColumns<{
    name: "mfa_challenges";
    schema: undefined;
    columns: {
        id: import("drizzle-orm/pg-core").PgColumn<{
            name: "id";
            tableName: "mfa_challenges";
            dataType: "string";
            columnType: "PgUUID";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: true;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        userId: import("drizzle-orm/pg-core").PgColumn<{
            name: "user_id";
            tableName: "mfa_challenges";
            dataType: "string";
            columnType: "PgUUID";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        sessionId: import("drizzle-orm/pg-core").PgColumn<{
            name: "session_id";
            tableName: "mfa_challenges";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        challengeToken: import("drizzle-orm/pg-core").PgColumn<{
            name: "challenge_token";
            tableName: "mfa_challenges";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        verified: import("drizzle-orm/pg-core").PgColumn<{
            name: "verified";
            tableName: "mfa_challenges";
            dataType: "boolean";
            columnType: "PgBoolean";
            data: boolean;
            driverParam: boolean;
            notNull: false;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        verifiedAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "verified_at";
            tableName: "mfa_challenges";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        attempts: import("drizzle-orm/pg-core").PgColumn<{
            name: "attempts";
            tableName: "mfa_challenges";
            dataType: "number";
            columnType: "PgInteger";
            data: number;
            driverParam: string | number;
            notNull: false;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        maxAttempts: import("drizzle-orm/pg-core").PgColumn<{
            name: "max_attempts";
            tableName: "mfa_challenges";
            dataType: "number";
            columnType: "PgInteger";
            data: number;
            driverParam: string | number;
            notNull: false;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "expires_at";
            tableName: "mfa_challenges";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        createdAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "created_at";
            tableName: "mfa_challenges";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
    };
    dialect: "pg";
}>;
export type UserMfaSelect = typeof userMfa.$inferSelect;
export type MfaBackupCodeSelect = typeof mfaBackupCodes.$inferSelect;
export type MfaChallengeSelect = typeof mfaChallenges.$inferSelect;
/**
 * Database store for MFA operations
 */
export declare class MfaStore {
    private db;
    constructor(database?: Database);
    /**
     * Create a new user MFA record
     */
    createUserMfa(input: CreateUserMfaInput): Promise<UserMfaRecord>;
    /**
     * Get user MFA record by user ID and tenant ID
     */
    getUserMfa(userId: string, tenantId: string): Promise<UserMfaRecord | null>;
    /**
     * Get user MFA record by ID
     */
    getUserMfaById(id: string): Promise<UserMfaRecord | null>;
    /**
     * Update user MFA status to active
     */
    activateUserMfa(id: string, gracePeriodEndsAt: Date): Promise<UserMfaRecord | null>;
    /**
     * Disable user MFA
     */
    disableUserMfa(userId: string, tenantId: string): Promise<UserMfaRecord | null>;
    /**
     * Delete user MFA record (and cascade to backup codes)
     */
    deleteUserMfa(userId: string, tenantId: string): Promise<boolean>;
    /**
     * Update enrollment expiry time
     */
    updateEnrollmentExpiry(id: string, expiresAt: Date): Promise<void>;
    /**
     * Create backup codes for a user MFA record
     */
    createBackupCodes(userMfaId: string, codeHashes: string[]): Promise<MfaBackupCodeRecord[]>;
    /**
     * Get unused backup codes for a user MFA record
     */
    getUnusedBackupCodes(userMfaId: string): Promise<MfaBackupCodeRecord[]>;
    /**
     * Get count of unused backup codes
     */
    getUnusedBackupCodeCount(userMfaId: string): Promise<number>;
    /**
     * Mark a backup code as used
     */
    markBackupCodeUsed(id: string, usedFromIp: string | null): Promise<MfaBackupCodeRecord | null>;
    /**
     * Delete all backup codes for a user MFA record
     */
    deleteBackupCodes(userMfaId: string): Promise<number>;
    /**
     * Create a new MFA challenge
     */
    createChallenge(input: CreateChallengeInput): Promise<MfaChallengeRecord>;
    /**
     * Get challenge by token
     */
    getChallengeByToken(challengeToken: string): Promise<MfaChallengeRecord | null>;
    /**
     * Get active challenge for a user session
     */
    getActiveChallenge(userId: string, sessionId: string): Promise<MfaChallengeRecord | null>;
    /**
     * Increment challenge attempts
     */
    incrementChallengeAttempts(id: string): Promise<MfaChallengeRecord | null>;
    /**
     * Get challenge by ID
     */
    getChallengeById(id: string): Promise<MfaChallengeRecord | null>;
    /**
     * Mark challenge as verified
     */
    markChallengeVerified(id: string): Promise<MfaChallengeRecord | null>;
    /**
     * Delete expired challenges
     */
    deleteExpiredChallenges(): Promise<number>;
    /**
     * Check if challenge is verified for a session
     */
    isSessionVerified(userId: string, sessionId: string): Promise<boolean>;
    private mapUserMfaRecord;
    private mapBackupCodeRecord;
    private mapChallengeRecord;
}
/**
 * Get the singleton MFA store instance
 */
export declare function getMfaStore(): MfaStore;
/**
 * Reset the singleton instance (for testing)
 */
export declare function resetMfaStore(): void;
/**
 * Create a new MFA store with custom database (for testing)
 */
export declare function createMfaStore(database: Database): MfaStore;
//# sourceMappingURL=mfa-store.d.ts.map