import { Querier, TransactionalDatabase } from '@platform-modules/db';
import { Principal, AuthEngine, UserAdminEngine } from '../index.js';
import { DeriveBitsFn } from '@platform-modules/util/password';
import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';

type PepperBinding = {
    /** Active pepper version label, e.g. `v1`. */
    currentVersion: string;
    /** Version → secret from a CF binding — never stored in the DB. */
    secrets: Record<string, string>;
};
/**
 * Returns `pbkdf2sha512-pep$<pepperVer>$<iter>$<saltB64>$<hmacB64>`.
 * Pepper is applied AFTER PBKDF2 — never pbkdf2(HMAC(pw, pepper)).
 */
declare function hashPassword(plain: string, pepper: PepperBinding, opts?: {
    deriveBits?: DeriveBitsFn;
}): Promise<string>;
/**
 * Returns true when the stored hash should be re-hashed on next successful login:
 * the pepper version is stale OR the stored work factor is below canonical ITERATIONS —
 * but never when the stored factor exceeds ITERATIONS (never silently downgrade a hash
 * imported at higher cost — raise ITERATIONS instead).
 *
 * Pepper rotation runbook:
 *   1. Add new version to secrets; set currentVersion to it.
 *   2. Monitor via countStalePasswordHashes until 0 old-version hashes remain.
 *   3. Only then remove the old version from secrets.
 * Skipping step 2 creates a timing gap: old-version hashes hit the early-return in verifyPassword
 * while the sentinel runs the full KDF, leaking which emails have un-migrated accounts.
 */
declare function shouldUpgradeHash(stored: string, currentPepperVersion: string): boolean;
/** Parses iter, salt, and pepper version from `stored` — never from module constants alone. */
declare function verifyPassword(plain: string, stored: string, pepper: PepperBinding, opts?: {
    deriveBits?: DeriveBitsFn;
}): Promise<boolean>;

/** Engine-owned identity row — `sessionVersion` drives `sv` revocation. */
declare const authUsers: drizzle_orm_pg_core.PgTableWithColumns<{
    name: "auth_users";
    schema: undefined;
    columns: {
        id: drizzle_orm_pg_core.PgColumn<{
            name: "id";
            tableName: "auth_users";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: true;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        email: drizzle_orm_pg_core.PgColumn<{
            name: "email";
            tableName: "auth_users";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        passwordHash: drizzle_orm_pg_core.PgColumn<{
            name: "password_hash";
            tableName: "auth_users";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        sessionVersion: drizzle_orm_pg_core.PgColumn<{
            name: "session_version";
            tableName: "auth_users";
            dataType: "number";
            columnType: "PgInteger";
            data: number;
            driverParam: string | number;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        roles: drizzle_orm_pg_core.PgColumn<{
            name: "roles";
            tableName: "auth_users";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        status: drizzle_orm_pg_core.PgColumn<{
            name: "status";
            tableName: "auth_users";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        createdAt: drizzle_orm_pg_core.PgColumn<{
            name: "created_at";
            tableName: "auth_users";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
    };
    dialect: "pg";
}>;
/** Idempotent DDL to create the auth_users table (neon-http: one statement). FK root — run first. */
declare const authUsersCreationSql: () => string;
/** Idempotent DDL to create the user_sessions table (neon-http: one statement). FKs auth_users. */
declare const userSessionsCreationSql: () => string;
/** Idempotent DDL for adopters migrating existing auth_users tables (neon-http: one statement). */
declare const authUsersStatusMigrationSql: () => string;
/** Idempotent DDL to create the service_tokens table (neon-http: one statement). FKs auth_users. */
declare const serviceTokensCreationSql: () => string;
/** One refresh-token row per device/session — no access-token hash column. */
declare const userSessions: drizzle_orm_pg_core.PgTableWithColumns<{
    name: "user_sessions";
    schema: undefined;
    columns: {
        id: drizzle_orm_pg_core.PgColumn<{
            name: "id";
            tableName: "user_sessions";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: true;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        userId: drizzle_orm_pg_core.PgColumn<{
            name: "user_id";
            tableName: "user_sessions";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        refreshTokenHash: drizzle_orm_pg_core.PgColumn<{
            name: "refresh_token_hash";
            tableName: "user_sessions";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        previousRefreshTokenHash: drizzle_orm_pg_core.PgColumn<{
            name: "previous_refresh_token_hash";
            tableName: "user_sessions";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        lastRefreshedAt: drizzle_orm_pg_core.PgColumn<{
            name: "last_refreshed_at";
            tableName: "user_sessions";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        expiresAt: drizzle_orm_pg_core.PgColumn<{
            name: "expires_at";
            tableName: "user_sessions";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        status: drizzle_orm_pg_core.PgColumn<{
            name: "status";
            tableName: "user_sessions";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
    };
    dialect: "pg";
}>;
/** Opaque machine/agent credential (PAT shape) — independent of userSessions; not rotating. */
declare const serviceTokens: drizzle_orm_pg_core.PgTableWithColumns<{
    name: "service_tokens";
    schema: undefined;
    columns: {
        id: drizzle_orm_pg_core.PgColumn<{
            name: "id";
            tableName: "service_tokens";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: true;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        userId: drizzle_orm_pg_core.PgColumn<{
            name: "user_id";
            tableName: "service_tokens";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        tokenHash: drizzle_orm_pg_core.PgColumn<{
            name: "token_hash";
            tableName: "service_tokens";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        label: drizzle_orm_pg_core.PgColumn<{
            name: "label";
            tableName: "service_tokens";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        expiresAt: drizzle_orm_pg_core.PgColumn<{
            name: "expires_at";
            tableName: "service_tokens";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        status: drizzle_orm_pg_core.PgColumn<{
            name: "status";
            tableName: "service_tokens";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        createdAt: drizzle_orm_pg_core.PgColumn<{
            name: "created_at";
            tableName: "service_tokens";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        lastUsedAt: drizzle_orm_pg_core.PgColumn<{
            name: "last_used_at";
            tableName: "service_tokens";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
    };
    dialect: "pg";
}>;
declare const customAuthSchema: {
    authUsers: drizzle_orm_pg_core.PgTableWithColumns<{
        name: "auth_users";
        schema: undefined;
        columns: {
            id: drizzle_orm_pg_core.PgColumn<{
                name: "id";
                tableName: "auth_users";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: true;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            email: drizzle_orm_pg_core.PgColumn<{
                name: "email";
                tableName: "auth_users";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            passwordHash: drizzle_orm_pg_core.PgColumn<{
                name: "password_hash";
                tableName: "auth_users";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: false;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            sessionVersion: drizzle_orm_pg_core.PgColumn<{
                name: "session_version";
                tableName: "auth_users";
                dataType: "number";
                columnType: "PgInteger";
                data: number;
                driverParam: string | number;
                notNull: true;
                hasDefault: true;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: undefined;
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            roles: drizzle_orm_pg_core.PgColumn<{
                name: "roles";
                tableName: "auth_users";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: true;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            status: drizzle_orm_pg_core.PgColumn<{
                name: "status";
                tableName: "auth_users";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: true;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            createdAt: drizzle_orm_pg_core.PgColumn<{
                name: "created_at";
                tableName: "auth_users";
                dataType: "date";
                columnType: "PgTimestamp";
                data: Date;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: undefined;
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
        };
        dialect: "pg";
    }>;
    userSessions: drizzle_orm_pg_core.PgTableWithColumns<{
        name: "user_sessions";
        schema: undefined;
        columns: {
            id: drizzle_orm_pg_core.PgColumn<{
                name: "id";
                tableName: "user_sessions";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: true;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            userId: drizzle_orm_pg_core.PgColumn<{
                name: "user_id";
                tableName: "user_sessions";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            refreshTokenHash: drizzle_orm_pg_core.PgColumn<{
                name: "refresh_token_hash";
                tableName: "user_sessions";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            previousRefreshTokenHash: drizzle_orm_pg_core.PgColumn<{
                name: "previous_refresh_token_hash";
                tableName: "user_sessions";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: false;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            lastRefreshedAt: drizzle_orm_pg_core.PgColumn<{
                name: "last_refreshed_at";
                tableName: "user_sessions";
                dataType: "date";
                columnType: "PgTimestamp";
                data: Date;
                driverParam: string;
                notNull: false;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: undefined;
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            expiresAt: drizzle_orm_pg_core.PgColumn<{
                name: "expires_at";
                tableName: "user_sessions";
                dataType: "date";
                columnType: "PgTimestamp";
                data: Date;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: undefined;
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            status: drizzle_orm_pg_core.PgColumn<{
                name: "status";
                tableName: "user_sessions";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: true;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
        };
        dialect: "pg";
    }>;
    serviceTokens: drizzle_orm_pg_core.PgTableWithColumns<{
        name: "service_tokens";
        schema: undefined;
        columns: {
            id: drizzle_orm_pg_core.PgColumn<{
                name: "id";
                tableName: "service_tokens";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: true;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            userId: drizzle_orm_pg_core.PgColumn<{
                name: "user_id";
                tableName: "service_tokens";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            tokenHash: drizzle_orm_pg_core.PgColumn<{
                name: "token_hash";
                tableName: "service_tokens";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            label: drizzle_orm_pg_core.PgColumn<{
                name: "label";
                tableName: "service_tokens";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            expiresAt: drizzle_orm_pg_core.PgColumn<{
                name: "expires_at";
                tableName: "service_tokens";
                dataType: "date";
                columnType: "PgTimestamp";
                data: Date;
                driverParam: string;
                notNull: false;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: undefined;
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            status: drizzle_orm_pg_core.PgColumn<{
                name: "status";
                tableName: "service_tokens";
                dataType: "string";
                columnType: "PgText";
                data: string;
                driverParam: string;
                notNull: true;
                hasDefault: true;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: [string, ...string[]];
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            createdAt: drizzle_orm_pg_core.PgColumn<{
                name: "created_at";
                tableName: "service_tokens";
                dataType: "date";
                columnType: "PgTimestamp";
                data: Date;
                driverParam: string;
                notNull: true;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: undefined;
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
            lastUsedAt: drizzle_orm_pg_core.PgColumn<{
                name: "last_used_at";
                tableName: "service_tokens";
                dataType: "date";
                columnType: "PgTimestamp";
                data: Date;
                driverParam: string;
                notNull: false;
                hasDefault: false;
                isPrimaryKey: false;
                isAutoincrement: false;
                hasRuntimeDefault: false;
                enumValues: undefined;
                baseColumn: never;
                identity: undefined;
                generated: undefined;
            }, {}, {}>;
        };
        dialect: "pg";
    }>;
};

type SessionUserRow = {
    sessionId: string;
    userId: string;
    sessionVersion: number;
    roles: string[];
};
type RotateRefreshResult = {
    kind: 'rotated';
    user: SessionUserRow;
    accessToken: string;
    refreshToken: string;
} | {
    kind: 'grace';
    user: SessionUserRow;
    accessToken: string;
} | {
    kind: 'race_lost';
    user: SessionUserRow;
    accessToken: string;
} | {
    kind: 'reuse_detected';
    userId: string;
    sessionId: string;
    newSessionVersion: number;
} | {
    kind: 'invalid';
};
declare function rotateRefreshToken<S extends Record<string, unknown>>(db: Querier<S>, tables: {
    authUsers: typeof authUsers;
    userSessions: typeof userSessions;
}, rawRefreshToken: string, jwtSecrets: string[]): Promise<RotateRefreshResult>;
declare function bumpSessionVersion<S extends Record<string, unknown>>(db: Querier<S>, usersTable: typeof authUsers, userId: string): Promise<number>;

declare function issueServiceToken<S extends Record<string, unknown>>(db: Querier<S>, tables: {
    authUsers: typeof authUsers;
    serviceTokens: typeof serviceTokens;
}, input: {
    userId: string;
    label: string;
    ttlMs?: number;
    now?: Date;
}): Promise<{
    id: string;
    token: string;
}>;
declare function resolveServiceToken<S extends Record<string, unknown>>(db: Querier<S>, tables: {
    authUsers: typeof authUsers;
    serviceTokens: typeof serviceTokens;
}, rawToken: string, opts?: {
    now?: Date;
}): Promise<Principal | null>;
declare function listServiceTokensForUser<S extends Record<string, unknown>>(db: Querier<S>, tables: {
    serviceTokens: typeof serviceTokens;
}, userId: string): Promise<Array<{
    id: string;
    label: string;
    createdAt: Date;
    expiresAt: Date | null;
    lastUsedAt: Date | null;
    status: string;
}>>;
declare function revokeServiceToken<S extends Record<string, unknown>>(db: Querier<S>, serviceTokensTable: typeof serviceTokens, id: string): Promise<void>;
declare function revokeServiceTokensForUser<S extends Record<string, unknown>>(db: Querier<S>, serviceTokensTable: typeof serviceTokens, userId: string): Promise<void>;

/**
 * Raw Web-Crypto HS256 session tokens.
 * Recomputes HMAC over received `header.payload`; never trusts header `alg`.
 */
type AccessClaims = {
    sub: string;
    sid: string;
    sv: number;
    iat: number;
    exp: number;
};
declare function signSession(claims: Omit<AccessClaims, 'iat' | 'exp'>, secret: string, ttlSec?: number): Promise<string>;
/** Verify against one or more secrets (rotation). Returns null on any failure — never throws. */
declare function verifySession(jwt: string, secrets: string | string[], opts?: {
    minSessionVersion?: number;
}): Promise<AccessClaims | null>;
declare const ACCESS_TOKEN_TTL_SECS: number;
declare const REFRESH_TOKEN_TTL_SECS: number;

type RateLimitScope = 'auth.login' | 'auth.refresh';
type RateLimitHook = (scope: RateLimitScope, subjectKey: string) => Promise<{
    allowed: boolean;
}>;
type CustomEngineConfig<S extends Record<string, unknown> = typeof customAuthSchema> = {
    db: TransactionalDatabase<S>;
    schema?: S;
    jwtSecrets: string[];
    pepper: PepperBinding;
    accessCookieName?: string;
    refreshCookieName?: string;
    rateLimit?: RateLimitHook;
};
declare class InvalidEngineConfigError extends Error {
    readonly field: 'jwtSecrets' | 'pepper';
    readonly name = "InvalidEngineConfigError";
    constructor(message: string, field: 'jwtSecrets' | 'pepper');
}
type UserSessionState = {
    sessionVersion: number;
    roles: string[];
    status: 'active' | 'disabled';
};
declare function lookupUserSessionState<S extends Record<string, unknown>>(db: Querier<S>, userId: string, usersTable?: typeof authUsers): Promise<UserSessionState | null>;
declare function createCustomEngine<S extends Record<string, unknown> = typeof customAuthSchema>(config: CustomEngineConfig<S>): AuthEngine & UserAdminEngine;
/**
 * Returns the count of password hashes NOT on the current pepper version.
 * Zero means every active hash has been lazily upgraded — safe to drop the old version
 * from `PepperBinding.secrets` without opening a timing gap. See `shouldUpgradeHash` runbook.
 */
declare function countStalePasswordHashes<S extends Record<string, unknown>>(db: Querier<S>, currentPepperVersion: string, usersTable?: typeof authUsers): Promise<number>;

export { ACCESS_TOKEN_TTL_SECS, type AccessClaims, type CustomEngineConfig, InvalidEngineConfigError, type PepperBinding, REFRESH_TOKEN_TTL_SECS, type RateLimitHook, type RateLimitScope, type UserSessionState, authUsers, authUsersCreationSql, authUsersStatusMigrationSql, bumpSessionVersion, countStalePasswordHashes, createCustomEngine, customAuthSchema, hashPassword, issueServiceToken, listServiceTokensForUser, lookupUserSessionState, resolveServiceToken, revokeServiceToken, revokeServiceTokensForUser, rotateRefreshToken, serviceTokens, serviceTokensCreationSql, shouldUpgradeHash, signSession, userSessions, userSessionsCreationSql, verifySession as verifyAccessToken, verifyPassword };