/**
 * @module identity/passkey-helper
 *
 * WebAuthn Level 3 PRF (Pseudo-Random Function) Passkey helper service.
 * Derives deterministic 256-bit symmetric secrets from hardware biometrics
 * (Touch ID, Windows Hello, Android Biometrics, YubiKey 5Ci) and creates
 * passkey device sync delegates.
 */
import { AuthenticatorTransport } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
/**
 * Checks if the browser and underlying platform authenticator support WebAuthn PRF.
 */
export declare function isPasskeyPrfSupported(): Promise<boolean>;
/**
 * Helper to convert an ArrayBuffer to a lowercase hex string.
 */
export declare function bufferToHex(buffer: ArrayBuffer | ArrayBufferLike): string;
/**
 * Helper to convert a hex string to a Uint8Array.
 */
export declare function hexToUint8Array(hex: string): Uint8Array;
/**
 * Helper to normalize a salt string or buffer into a 32-byte Uint8Array for PRF evaluation.
 */
export declare function normalizeSaltTo32Bytes(salt: string | Uint8Array): Uint8Array;
/**
 * Creates and registers a new WebAuthn resident passkey credential with PRF enabled.
 */
/**
 * Creates and registers a new WebAuthn resident passkey credential with PRF enabled.
 */
export declare function registerPasskeyCredential({ username, displayName, rpName, rpId, salt, userVerification, authenticatorAttachment, hints, }: {
    username: string;
    displayName?: string;
    rpName?: string;
    rpId?: string;
    salt?: string | Uint8Array;
    userVerification?: UserVerificationRequirement;
    authenticatorAttachment?: AuthenticatorAttachment;
    hints?: ('security-key' | 'client-device' | 'hybrid')[];
}): Promise<{
    credentialId: string;
    rawId: ArrayBuffer;
    transports: AuthenticatorTransport[];
    passkeySecret?: string;
}>;
/**
 * Evaluates the PRF extension on a passkey assertion to derive a deterministic 256-bit symmetric secret.
 */
export declare function evaluatePasskeyPrf({ salt, credentialId, transports, rpId, userVerification, hints, }: {
    salt: string | Uint8Array;
    credentialId?: string;
    transports?: AuthenticatorTransport[];
    rpId?: string;
    userVerification?: UserVerificationRequirement;
    hints?: ('security-key' | 'client-device' | 'hybrid')[];
}): Promise<{
    passkeySecret: string;
    credentialId: string;
}>;
/**
 * Creates a Passkey sovereign sync delegate for this device.
 * Standardized format: `passkey-${safeUsername}-${defaultDeviceTag}`
 */
export declare function createPasskeyDeviceSyncDelegate({ username, primaryTjpAddr, passkeySecret, transports, metaspace, space, }: {
    username: string;
    primaryTjpAddr: string;
    passkeySecret: string;
    transports?: AuthenticatorTransport[];
    metaspace?: any;
    space?: any;
}): Promise<{
    delegateKeystone: any;
    deviceTag: string;
    delegateSecret: string;
}>;
//# sourceMappingURL=passkey-helper.d.mts.map