/**
 * @typedef {object} AuthFlags
 * @property {number} raw   The whole flag byte, for round-trip / debugging.
 * @property {boolean} up   User Present.
 * @property {boolean} uv   User Verified.
 * @property {boolean} be   Backup Eligible.
 * @property {boolean} bs   Backup State (backed up right now).
 * @property {boolean} at   Attested credential data included.
 * @property {boolean} ed   Extension data included.
 */
/**
 * Decode the flag byte into a structured record.
 *
 * @param {number} byte
 * @returns {AuthFlags}
 */
export function decodeFlags(byte: number): AuthFlags;
/**
 * Derive a device-type label from the BE flag. Follows the
 * WebAuthn L3 §6.1.3 convention adopted by browsers and MDS —
 * BE=1 means the credential is eligible for syncing across
 * devices (a "multiDevice" passkey); BE=0 means it lives on
 * one authenticator only.
 *
 * @param {AuthFlags} flags
 * @returns {'singleDevice' | 'multiDevice'}
 */
export function deviceTypeFromFlags(flags: AuthFlags): "singleDevice" | "multiDevice";
/**
 * Enforce user-presence / verification / backup policies against
 * decoded flags. Throws a `PasskeyError` with the code that matches
 * the violated bit — callers can distinguish `USER_VERIFICATION_REQUIRED`
 * from `BACKUP_ELIGIBLE_REQUIRED` without string-matching messages.
 *
 * `up` is always required — WebAuthn spec §7.1 step 15 and §7.2 step
 * 17 both mandate it. The rest are opt-in.
 *
 * @param {AuthFlags} flags
 * @param {object} [policy]
 * @param {boolean} [policy.requireUserVerification]
 * @param {boolean} [policy.requireBackupEligible]
 * @param {boolean} [policy.requireBackedUp]
 */
export function enforceFlags(flags: AuthFlags, policy?: {
    requireUserVerification?: boolean | undefined;
    requireBackupEligible?: boolean | undefined;
    requireBackedUp?: boolean | undefined;
}): void;
export const FLAG_MASK: Readonly<{
    UP: 1;
    UV: 4;
    BE: 8;
    BS: 16;
    AT: 64;
    ED: 128;
}>;
export type AuthFlags = {
    /**
     * The whole flag byte, for round-trip / debugging.
     */
    raw: number;
    /**
     * User Present.
     */
    up: boolean;
    /**
     * User Verified.
     */
    uv: boolean;
    /**
     * Backup Eligible.
     */
    be: boolean;
    /**
     * Backup State (backed up right now).
     */
    bs: boolean;
    /**
     * Attested credential data included.
     */
    at: boolean;
    /**
     * Extension data included.
     */
    ed: boolean;
};