import type { AssuranceLevel } from './approval.js';
/**
 * The WebAuthn challenge a passkey signs (L2): a 32-byte sha256 binding the
 * operation. The frontend sets `navigator.credentials.get({publicKey:{challenge}})`
 * to these bytes; the action recomputes and matches against clientDataJSON.
 */
export declare function stepUpChallenge(f: StepUpFields): Uint8Array;
export interface StepUpFields {
    approvalId: string;
    intentHash: string;
    accountNonce: number;
}
/** The EIP-712 digest a wallet signs (and the action reconstructs to recover). */
export declare function stepUpDigest(f: StepUpFields): Uint8Array;
/** L3 EOA co-sign helper (tests / the backend mock; real users sign via their wallet). */
export declare function signStepUpEoa(privateKeyHex: string, f: StepUpFields): string;
/** L3: the user's EOA co-signs (EIP-712). L2: a passkey/WebAuthn assertion. */
export type StepUpProof = {
    kind: 'eip712-eoa';
    signature: string;
} | {
    kind: 'webauthn-p256';
    authenticatorData: string;
    clientDataJSON: string;
    signature: string;
    /**
     * base64url WebAuthn credential id of the asserting key — a LOOKUP HINT so
     * the verifier can resolve which of the user's registered ACCOUNT passkeys
     * to pin `credential.publicKey` from. Never part of the cryptographic
     * verification itself (the pinned pubkey is the trust root).
     */
    credentialId?: string;
};
export type StepUpCredential = {
    kind: 'eip712-eoa';
    address: string;
} | {
    kind: 'webauthn-p256';
    publicKey: string;
};
export interface VerifyStepUpOptions {
    proof: StepUpProof;
    intentHash: string;
    approvalId: string;
    accountNonce: number;
    requiredAssurance: AssuranceLevel;
    credential: StepUpCredential;
    /** Required for webauthn-p256: the RP id + accepted origins (pinned constants). */
    webauthn?: {
        rpId: string;
        allowedOrigins: string[];
    };
}
export type StepUpReason = 'unsupported_kind' | 'bad_proof' | 'wrong_signer' | 'no_stepup_required' | 'bad_challenge' | 'bad_origin' | 'bad_rp' | 'user_not_verified';
export interface StepUpCheck {
    ok: boolean;
    reason?: StepUpReason;
    signer?: string;
}
export declare function verifyStepUp(opts: VerifyStepUpOptions): StepUpCheck;