import { type StepUpAssertionEnvelope, type StepUpVerifyFailure } from './step-up-webauthn.js';
import type { StepUpAssertionVerifier } from './step-up-policy.js';
/** User-verification requirement for the ceremony. Default `required`. */
export type UserVerificationRequirement = 'required' | 'preferred' | 'discouraged';
/** Minimal secret custody surface (the SecretsManager satisfies it). */
export interface StepUpSecretStore {
    get(key: string): Promise<string | null>;
    set(key: string, value: string): Promise<void>;
}
export interface StepUpServiceOptions {
    readonly secrets: StepUpSecretStore;
    /** Clock injection for deterministic tests. Default `Date.now`. */
    readonly now?: () => number;
    /** Random-challenge source injection for tests. Default relay `randomBytes`. */
    readonly randomChallenge?: () => Uint8Array<ArrayBuffer>;
    readonly logger?: {
        warn(message: string, fields?: Record<string, unknown>): void;
    };
}
/** Input to register a step-up credential (an admin/local-only ceremony verb). */
export interface RegisterStepUpCredentialInput {
    readonly rpId: string;
    readonly origin: string | readonly string[];
    readonly credentialId: string;
    readonly publicKeyCose: string;
    readonly signCount?: number;
    readonly userVerification?: UserVerificationRequirement;
    readonly label?: string;
}
/** A public (no key material) summary of a registered credential. */
export interface StepUpCredentialSummary {
    readonly credentialId: string;
    readonly label?: string;
    readonly createdAt: number;
    readonly signCount: number;
}
/** Input to mint a challenge, bound to the session/rendezvous it is for. */
export interface MintStepUpChallengeInput {
    readonly rendezvousId?: string;
    readonly sessionId?: string;
    /** Freshness window in ms (clamped 5s–300s). Default 120s. */
    readonly ttlMs?: number;
}
/** A minted challenge a surface passes to `navigator.credentials.get`. */
export interface MintedStepUpChallenge {
    readonly challengeId: string;
    /** base64url challenge bytes. */
    readonly challenge: string;
    readonly expiresAt: number;
}
/** Refusal reasons the verifier surfaces beyond the crypto failures. */
export type StepUpChallengeFailure = 'no-credential' | 'unknown-challenge' | 'challenge-expired' | 'challenge-consumed';
/**
 * The step-up ceremony service. Constructed once at RuntimeServices assembly and
 * shared between the ceremony verbs and the relay gate's verifier.
 */
export declare class StepUpService {
    private readonly secrets;
    private readonly now;
    private readonly randomChallenge;
    private readonly logger;
    private readonly challenges;
    constructor(options: StepUpServiceOptions);
    private loadState;
    private saveState;
    /**
     * Register (or replace) a credential and establish the deployment policy. The
     * COSE public key must parse as an EC2 P-256 key or the registration is
     * refused, a broken key would only fail closed silently later.
     */
    registerCredential(input: RegisterStepUpCredentialInput): Promise<StepUpCredentialSummary>;
    /** Mint a short-lived, single-use challenge bound to the session/rendezvous. */
    mintChallenge(input?: MintStepUpChallengeInput): MintedStepUpChallenge;
    private pruneExpired;
    /**
     * The real {@link StepUpAssertionVerifier}. It parses the header envelope,
     * confirms the signed challenge is one we minted and is still live+unconsumed,
     * runs the full WebAuthn verification against the registered credential, and,
     * only on complete success, consumes the challenge and advances the stored
     * signature counter. Every other path returns false (fail closed).
     */
    createVerifier(): StepUpAssertionVerifier;
    /** Verify an envelope, returning a specific outcome (used by the verifier and tests). */
    verify(assertion: string): Promise<{
        ok: true;
    } | {
        ok: false;
        reason: StepUpVerifyFailure | StepUpChallengeFailure | 'malformed-envelope';
    }>;
}
/** Decode the `x-goodvibes-stepup-assertion` header value into an envelope. */
export declare function parseAssertionHeader(value: string): StepUpAssertionEnvelope | null;
/** Encode an envelope into the header value form (base64url of the JSON). */
export declare function encodeAssertionHeader(envelope: StepUpAssertionEnvelope): string;
//# sourceMappingURL=step-up-service.d.ts.map