/**
 * Build the `extensions` dict for `PublicKeyCredentialCreationOptionsJSON`.
 * Every key is optional; unknown keys pass through untouched so
 * callers can experiment with in-flight spec drafts without waiting
 * for a library update.
 *
 * @param {object} [input]
 * @param {true} [input.credProps]                  request credProps output
 * @param {{ support: 'preferred' | 'required' }} [input.largeBlob]
 * @param {{ eval?: { first: Uint8Array, second?: Uint8Array } }} [input.prf]
 * @param {true} [input.hmacCreateSecret]           request hmac-secret at register time
 * @param {true} [input.minPinLength]
 * @param {number} [input.credentialProtectionPolicy]  1/2/3 per CTAP2 §12.1
 * @param {boolean} [input.enforceCredentialProtectionPolicy]
 * @param {string} [input.appidExclude]             legacy U2F migration
 * @returns {Record<string, unknown>}
 */
export function buildRegistrationExtensions(input?: {
    credProps?: true | undefined;
    largeBlob?: {
        support: "preferred" | "required";
    } | undefined;
    prf?: {
        eval?: {
            first: Uint8Array;
            second?: Uint8Array;
        };
    } | undefined;
    hmacCreateSecret?: true | undefined;
    minPinLength?: true | undefined;
    credentialProtectionPolicy?: number | undefined;
    enforceCredentialProtectionPolicy?: boolean | undefined;
    appidExclude?: string | undefined;
}): Record<string, unknown>;
/**
 * Build the `extensions` dict for `PublicKeyCredentialRequestOptionsJSON`.
 *
 * @param {object} [input]
 * @param {{ read?: true, write?: Uint8Array }} [input.largeBlob]
 * @param {{ eval?: { first: Uint8Array, second?: Uint8Array },
 *          evalByCredential?: Record<string, { first: Uint8Array, second?: Uint8Array }> }} [input.prf]
 * @param {{ salt1: Uint8Array, salt2?: Uint8Array }} [input.hmacGetSecret]
 * @param {string} [input.appid]
 * @returns {Record<string, unknown>}
 */
export function buildAuthenticationExtensions(input?: {
    largeBlob?: {
        read?: true;
        write?: Uint8Array;
    } | undefined;
    prf?: {
        eval?: {
            first: Uint8Array;
            second?: Uint8Array;
        };
        evalByCredential?: Record<string, {
            first: Uint8Array;
            second?: Uint8Array;
        }>;
    } | undefined;
    hmacGetSecret?: {
        salt1: Uint8Array;
        salt2?: Uint8Array;
    } | undefined;
    appid?: string | undefined;
}): Record<string, unknown>;
/**
 * Normalise the client-provided `clientExtensionResults` JSON.
 *
 * Binary fields (`largeBlob.blob`, `prf.results.first/second`) come
 * in as base64url strings; we decode them to `Uint8Array`. Unknown
 * keys are surfaced verbatim under `raw` so callers can inspect them
 * without waiting on us to name every draft extension.
 *
 * ⚠ `out.raw` is the client's original object, unbounded and
 * untrusted. Callers who log or persist the normalised extension
 * record should treat `raw` as attacker-controlled input — decide
 * whether to strip it before storing, and never render it as-is.
 *
 * @param {Record<string, unknown> | undefined | null} results
 * @returns {Record<string, unknown>}
 */
export function readClientExtensionResults(results: Record<string, unknown> | undefined | null): Record<string, unknown>;
/**
 * Normalise the authenticator-produced extensions map (from
 * `authData.extensions`, a CBOR `Map`).
 *
 * @param {Map<unknown, unknown> | null | undefined} map
 * @returns {Record<string, unknown>}
 */
export function readAuthenticatorExtensions(map: Map<unknown, unknown> | null | undefined): Record<string, unknown>;