/**
 * Decode a challenge-lib token's payload without verifying the MAC.
 * We only use this at `begin` time — the token was just minted, so
 * we can trust ourselves. Verification happens at `finish` time via
 * `verifyChallenge`.
 *
 * @param {string} token
 * @returns {{ jti: string }}
 */
export function readIssuedJti(token: string): {
    jti: string;
};
/**
 * Issue a challenge for a passkey flow. Returns the compact token
 * (the app hands this back at `finish`) and the base64url challenge
 * value the browser will echo in `clientDataJSON`.
 *
 * @param {object} options
 * @param {string | Buffer} options.secret
 * @param {import('@exortek/challenge').IncrStore} options.store
 * @param {string} options.step        `'register'` | `'authenticate'`
 * @param {string} [options.userId]
 * @param {string | number} [options.expiresIn=300_000]  challenge TTL
 * @param {string} [options.prefix]
 * @returns {Promise<{ challengeToken: string, challengeBase64Url: string }>}
 */
export function issuePasskeyChallenge(options: {
    secret: string | Buffer;
    store: import("@exortek/challenge").IncrStore;
    step: string;
    userId?: string | undefined;
    expiresIn?: string | number | undefined;
    prefix?: string | undefined;
}): Promise<{
    challengeToken: string;
    challengeBase64Url: string;
}>;
/**
 * Verify a challenge token and confirm it matches the challenge
 * carried in `clientDataJSON`.
 *
 * @param {object} options
 * @param {string} options.challengeToken
 * @param {string} options.challengeBase64UrlFromClient
 * @param {string | Buffer} options.secret
 * @param {import('@exortek/challenge').IncrStore} options.store
 * @param {string} options.step
 * @param {string} [options.userId]
 * @param {string} [options.prefix]
 * @returns {Promise<void>}
 */
export function consumePasskeyChallenge(options: {
    challengeToken: string;
    challengeBase64UrlFromClient: string;
    secret: string | Buffer;
    store: import("@exortek/challenge").IncrStore;
    step: string;
    userId?: string | undefined;
    prefix?: string | undefined;
}): Promise<void>;