import * as _exortek_challenge from '@exortek/challenge';

/**
 * @param {object} params
 * @param {{ id: string, name: string }} params.rp
 * @param {{ id: string, name: string, displayName: string }} params.user
 * @param {string | Buffer} params.challengeSecret
 * @param {import('@exortek/challenge').IncrStore} params.challengeStore
 * @param {object} [params.authenticatorSelection]
 * @param {'none' | 'direct' | 'enterprise'} [params.attestation='none']
 * @param {Array<'security-key' | 'client-device' | 'hybrid'>} [params.hints]
 * @param {number} [params.timeoutMs=60_000]
 * @param {Array<{ id: string | Uint8Array, type?: string, transports?: string[] }>} [params.excludeCredentials]
 * @param {object} [params.extensions]
 * @param {number[]} [params.supportedAlgorithms]
 * @param {string | number} [params.challengeExpiresIn='5m']
 * @param {string} [params.challengePrefix]
 * @returns {Promise<{
 *   options: Record<string, unknown>,
 *   challengeToken: string,
 * }>}
 */
declare function begin$1(params: {
    rp: {
        id: string;
        name: string;
    };
    user: {
        id: string;
        name: string;
        displayName: string;
    };
    challengeSecret: string | Buffer;
    challengeStore: _exortek_challenge.IncrStore;
    authenticatorSelection?: object | undefined;
    attestation?: "none" | "direct" | "enterprise" | undefined;
    hints?: ("security-key" | "client-device" | "hybrid")[] | undefined;
    timeoutMs?: number | undefined;
    excludeCredentials?: {
        id: string | Uint8Array;
        type?: string;
        transports?: string[];
    }[] | undefined;
    extensions?: object | undefined;
    supportedAlgorithms?: number[] | undefined;
    challengeExpiresIn?: string | number | undefined;
    challengePrefix?: string | undefined;
}): Promise<{
    options: Record<string, unknown>;
    challengeToken: string;
}>;

/**
 * @param {object} params
 * @param {object} params.response
 *   The `PublicKeyCredential` shape the browser produced, with
 *   base64url-encoded fields (JSON-transport form):
 *     { id, rawId, type: 'public-key',
 *       response: { clientDataJSON, attestationObject, transports? },
 *       clientExtensionResults? }
 * @param {string} params.challengeToken
 * @param {string | string[]} params.expectedRpId
 * @param {string | string[] | RegExp} params.expectedOrigin
 * @param {string | Buffer} params.challengeSecret
 * @param {import('@exortek/challenge').IncrStore} params.challengeStore
 * @param {string} [params.expectedUserId]
 * @param {boolean} [params.requireUserVerification=true]
 * @param {boolean} [params.requireBackupEligible=false]
 * @param {boolean} [params.requireBackedUp=false]
 * @param {boolean} [params.allowCrossOriginCeremony=false]
 *   Opt in to accepting `clientDataJSON.crossOrigin === true`. Off by
 *   default: WebAuthn L3 §7.1 step 12 lets the RP set policy, and
 *   most deployments should not accept cross-origin registration
 *   ceremonies.
 * @param {number[]} [params.supportedAlgorithms]
 * @param {Record<string, Array<unknown>>} [params.trustAnchors]
 *   Per-format trust anchor arrays; each entry is a certificate
 *   accepted by `x509/chain.toCertificate` (PEM string / DER / X509).
 * @param {Record<string, Record<string, unknown>>} [params.attestationOptions]
 *   Per-format extra options, keyed by format name (same convention as
 *   `trustAnchors`). Passed verbatim to the format's verifier — used
 *   today by `android-safetynet` (`enforceCtsCheck`,
 *   `timestampWindowMs`, `now`); new formats add knobs here without
 *   further signature changes.
 * @param {boolean} [params.requireTrustAnchor=false]
 *   When true, reject a chain-bearing attestation format that resolved
 *   to `trustPath: 'no-anchor'` (i.e. the caller supplied no anchors
 *   for it). Turns the "attestation silently unverified" footgun into
 *   an explicit `ATTESTATION_TRUST_ANCHOR_MISSING`. `none` and packed
 *   self-attestation are unaffected. Leave false for the passkey common
 *   case (`attestation: 'none'`).
 * @param {string} [params.challengePrefix]
 * @returns {Promise<{
 *   credential: {
 *     id: string,
 *     idBytes: Uint8Array,
 *     publicKey: import('node:crypto').KeyObject,
 *     publicKeyJwk: Record<string, unknown>,
 *     publicKeyCose: Map<unknown, unknown>,
 *     algorithm: number,
 *     counter: number,
 *     transports?: string[],
 *   },
 *   aaguid: string,
 *   deviceType: 'singleDevice' | 'multiDevice',
 *   backedUp: boolean,
 *   attestation: {
 *     format: string,
 *     trustPath: string,
 *     aaguidExtensionOk?: boolean,
 *     certChain?: import('node:crypto').X509Certificate[],
 *   },
 *   extensionResults: { client: object, authenticator: object },
 *   rpId: string,
 * }>}
 */
declare function finish$1(params: {
    response: object;
    challengeToken: string;
    expectedRpId: string | string[];
    expectedOrigin: string | string[] | RegExp;
    challengeSecret: string | Buffer;
    challengeStore: _exortek_challenge.IncrStore;
    expectedUserId?: string | undefined;
    requireUserVerification?: boolean | undefined;
    requireBackupEligible?: boolean | undefined;
    requireBackedUp?: boolean | undefined;
    allowCrossOriginCeremony?: boolean | undefined;
    supportedAlgorithms?: number[] | undefined;
    trustAnchors?: Record<string, unknown[]> | undefined;
    attestationOptions?: Record<string, Record<string, unknown>> | undefined;
    requireTrustAnchor?: boolean | undefined;
    challengePrefix?: string | undefined;
}): Promise<{
    credential: {
        id: string;
        idBytes: Uint8Array;
        publicKey: any;
        publicKeyJwk: Record<string, unknown>;
        publicKeyCose: Map<unknown, unknown>;
        algorithm: number;
        counter: number;
        transports?: string[];
    };
    aaguid: string;
    deviceType: "singleDevice" | "multiDevice";
    backedUp: boolean;
    attestation: {
        format: string;
        trustPath: string;
        aaguidExtensionOk?: boolean;
        certChain?: any[];
    };
    extensionResults: {
        client: object;
        authenticator: object;
    };
    rpId: string;
}>;

declare namespace index_d$1 {
  export {
    begin$1 as begin,
    finish$1 as finish,
  };
}

/**
 * @param {object} params
 * @param {string | string[]} params.rpId
 * @param {string | Buffer} params.challengeSecret
 * @param {import('@exortek/challenge').IncrStore} params.challengeStore
 * @param {Array<{ id: string | Uint8Array, type?: string, transports?: string[] }>} [params.allowCredentials]
 * @param {'required' | 'preferred' | 'discouraged'} [params.userVerification]
 * @param {Array<'security-key' | 'client-device' | 'hybrid'>} [params.hints]
 * @param {number} [params.timeoutMs=60_000]
 * @param {object} [params.extensions]
 * @param {boolean} [params.conditional]
 * @param {string} [params.userId]
 * @param {string | number} [params.challengeExpiresIn='5m']
 * @param {string} [params.challengePrefix]
 * @returns {Promise<{
 *   options: Record<string, unknown>,
 *   challengeToken: string,
 * }>}
 */
declare function begin(params: {
    rpId: string | string[];
    challengeSecret: string | Buffer;
    challengeStore: _exortek_challenge.IncrStore;
    allowCredentials?: {
        id: string | Uint8Array;
        type?: string;
        transports?: string[];
    }[] | undefined;
    userVerification?: "preferred" | "required" | "discouraged" | undefined;
    hints?: ("security-key" | "client-device" | "hybrid")[] | undefined;
    timeoutMs?: number | undefined;
    extensions?: object | undefined;
    conditional?: boolean | undefined;
    userId?: string | undefined;
    challengeExpiresIn?: string | number | undefined;
    challengePrefix?: string | undefined;
}): Promise<{
    options: Record<string, unknown>;
    challengeToken: string;
}>;

/**
 * @param {object} params
 * @param {object} params.response
 * @param {string} params.challengeToken
 * @param {string | string[]} params.expectedRpId
 * @param {string | string[] | RegExp} params.expectedOrigin
 * @param {string | Buffer} params.challengeSecret
 * @param {import('@exortek/challenge').IncrStore} params.challengeStore
 * @param {{
 *   publicKey?: import('node:crypto').KeyObject,
 *   publicKeyCose?: Map<unknown, unknown>,
 *   algorithm?: number,
 *   counter: number,
 *   transports?: string[],
 * }} params.credential
 * @param {string} [params.expectedUserId]
 * @param {boolean} [params.requireUserVerification=true]
 * @param {boolean} [params.requireBackupEligible=false]
 * @param {boolean} [params.requireBackedUp=false]
 * @param {boolean} [params.allowCrossOriginCeremony=false]
 *   Opt in to accepting `clientDataJSON.crossOrigin === true`. Off by
 *   default, matching registration.finish — the assertion is normally
 *   invoked from the top-level RP origin.
 * @param {string} [params.challengePrefix]
 * @returns {Promise<{
 *   verified: true,
 *   newCounter: number,
 *   credentialId: string,
 *   userHandle: Uint8Array | null,
 *   deviceType: 'singleDevice' | 'multiDevice',
 *   backedUp: boolean,
 *   extensionResults: { client: object, authenticator: object },
 *   rpId: string,
 * }>}
 */
declare function finish(params: {
    response: object;
    challengeToken: string;
    expectedRpId: string | string[];
    expectedOrigin: string | string[] | RegExp;
    challengeSecret: string | Buffer;
    challengeStore: _exortek_challenge.IncrStore;
    credential: {
        publicKey?: any;
        publicKeyCose?: Map<unknown, unknown>;
        algorithm?: number;
        counter: number;
        transports?: string[];
    };
    expectedUserId?: string | undefined;
    requireUserVerification?: boolean | undefined;
    requireBackupEligible?: boolean | undefined;
    requireBackedUp?: boolean | undefined;
    allowCrossOriginCeremony?: boolean | undefined;
    challengePrefix?: string | undefined;
}): Promise<{
    verified: true;
    newCounter: number;
    credentialId: string;
    userHandle: Uint8Array | null;
    deviceType: "singleDevice" | "multiDevice";
    backedUp: boolean;
    extensionResults: {
        client: object;
        authenticator: object;
    };
    rpId: string;
}>;

declare const index_d_begin: typeof begin;
declare const index_d_finish: typeof finish;
declare namespace index_d {
  export {
    index_d_begin as begin,
    index_d_finish as finish,
  };
}

/**
 * Shared base error class — the single error structure behind every
 * `@exortek/*` package's `errors.js`.
 *
 * Every package keeps its own class identity with a one-liner subclass;
 * codes stay per-package frozen maps, status mapping is declared as a
 * static field:
 *
 *   import { BaseError } from '@exortek/shared/errors';
 *
 *   export const ErrorCode = Object.freeze({
 *     INVALID_ARGUMENT: 'INVALID_ARGUMENT',
 *     INVALID_TOKEN: 'INVALID_TOKEN',
 *   });
 *
 *   export class JwtError extends BaseError {
 *     static statuses = { INVALID_ARGUMENT: 400, INVALID_TOKEN: 401 };
 *     static defaultStatus = 500;
 *   }
 *
 * Instances carry a stable machine-readable `code` (branch on this,
 * never on the message), an optional HTTP `status`, an optional
 * `details` object, and the standard `cause` chain.
 */
declare class BaseError extends Error {
    /**
     * Optional `code → HTTP status` map declared on the subclass. When
     * absent the instance carries no `status` at all — for HTTP-agnostic
     * packages like `@exortek/crypto`.
     *
     * @type {Record<string, number> | undefined}
     */
    static statuses: Record<string, number> | undefined;
    /**
     * Fallback status for codes missing from `statuses`.
     *
     * @type {number}
     */
    static defaultStatus: number;
    /**
     * @param {string} code    Stable machine-readable code; branch on this.
     * @param {string} message Human-readable diagnostic. Free-form; may
     *                         change across versions.
     * @param {{ cause?: unknown, status?: number, details?: Record<string, unknown> }} [options]
     */
    constructor(code: string, message: string, options?: {
        cause?: unknown;
        status?: number;
        details?: Record<string, unknown>;
    });
    /** @type {string} */
    code: string;
    /** @type {number | undefined} */
    status: number | undefined;
    /** @type {Record<string, unknown> | undefined} */
    details: Record<string, unknown> | undefined;
}

declare const ErrorCode: Readonly<{
    INVALID_ARGUMENT: "INVALID_ARGUMENT";
    CHALLENGE_MISMATCH: "CHALLENGE_MISMATCH";
    CHALLENGE_EXPIRED: "CHALLENGE_EXPIRED";
    CHALLENGE_ALREADY_USED: "CHALLENGE_ALREADY_USED";
    CHALLENGE_INVALID: "CHALLENGE_INVALID";
    ORIGIN_MISMATCH: "ORIGIN_MISMATCH";
    RP_ID_MISMATCH: "RP_ID_MISMATCH";
    CLIENT_DATA_INVALID: "CLIENT_DATA_INVALID";
    AUTH_DATA_INVALID: "AUTH_DATA_INVALID";
    USER_VERIFICATION_REQUIRED: "USER_VERIFICATION_REQUIRED";
    USER_PRESENCE_REQUIRED: "USER_PRESENCE_REQUIRED";
    BACKUP_ELIGIBLE_REQUIRED: "BACKUP_ELIGIBLE_REQUIRED";
    BACKED_UP_REQUIRED: "BACKED_UP_REQUIRED";
    SIGNATURE_INVALID: "SIGNATURE_INVALID";
    COUNTER_ROLLBACK: "COUNTER_ROLLBACK";
    PUBLIC_KEY_UNSUPPORTED: "PUBLIC_KEY_UNSUPPORTED";
    UNSUPPORTED_ALGORITHM: "UNSUPPORTED_ALGORITHM";
    ATTESTATION_INVALID: "ATTESTATION_INVALID";
    ATTESTATION_TRUST_ANCHOR_MISSING: "ATTESTATION_TRUST_ANCHOR_MISSING";
    UNSUPPORTED_ATTESTATION_FORMAT: "UNSUPPORTED_ATTESTATION_FORMAT";
    EXTENSION_INVALID: "EXTENSION_INVALID";
    MDS_BLOB_INVALID: "MDS_BLOB_INVALID";
    DECODE_ERROR: "DECODE_ERROR";
}>;
declare class PasskeyError extends BaseError {
    static statuses: {
        INVALID_ARGUMENT: number;
        CHALLENGE_MISMATCH: number;
        CHALLENGE_EXPIRED: number;
        CHALLENGE_ALREADY_USED: number;
        CHALLENGE_INVALID: number;
        ORIGIN_MISMATCH: number;
        RP_ID_MISMATCH: number;
        CLIENT_DATA_INVALID: number;
        AUTH_DATA_INVALID: number;
        USER_VERIFICATION_REQUIRED: number;
        USER_PRESENCE_REQUIRED: number;
        BACKUP_ELIGIBLE_REQUIRED: number;
        BACKED_UP_REQUIRED: number;
        SIGNATURE_INVALID: number;
        COUNTER_ROLLBACK: number;
        PUBLIC_KEY_UNSUPPORTED: number;
        UNSUPPORTED_ALGORITHM: number;
        ATTESTATION_INVALID: number;
        ATTESTATION_TRUST_ANCHOR_MISSING: number;
        UNSUPPORTED_ATTESTATION_FORMAT: number;
        EXTENSION_INVALID: number;
        MDS_BLOB_INVALID: number;
        DECODE_ERROR: number;
    };
}

export { ErrorCode, PasskeyError, index_d as authentication, index_d$1 as registration };