/** A stored step-up credential: what the daemon persists per registered passkey. */
export interface StoredStepUpCredential {
    /** base64url credential id (the authenticator's credentialId). */
    readonly credentialId: string;
    /** base64url COSE_Key (EC2 P-256) public key, exactly as WebAuthn registration yields. */
    readonly publicKeyCose: string;
    /** The last observed signature counter; regression below this is refused. */
    readonly signCount: number;
    /** Optional operator-facing label. */
    readonly label?: string;
    /** Registration time (ms epoch). */
    readonly createdAt: number;
}
/** The assertion envelope a surface sends in the step-up header (all base64url). */
export interface StepUpAssertionEnvelope {
    readonly credentialId: string;
    readonly authenticatorData: string;
    readonly clientDataJSON: string;
    /** ASN.1 DER ECDSA signature, exactly as WebAuthn's `assertion.response.signature` yields. */
    readonly signature: string;
}
/** Parameters a single assertion verification binds against. */
export interface StepUpVerifyParams {
    readonly envelope: StepUpAssertionEnvelope;
    readonly credential: StoredStepUpCredential;
    /** base64url of the server-issued challenge bytes the assertion must echo. */
    readonly expectedChallenge: string;
    /** The relying-party id (effective domain) whose SHA-256 must equal authData.rpIdHash. */
    readonly rpId: string;
    /** Allowed clientData origins (exact-match). */
    readonly allowedOrigins: readonly string[];
    /** Require the user-verification flag (default true = required). */
    readonly requireUserVerification: boolean;
}
/** A machine-readable verification refusal reason. Never a generic boolean. */
export type StepUpVerifyFailure = 'malformed-envelope' | 'malformed-client-data' | 'wrong-type' | 'challenge-mismatch' | 'origin-not-allowed' | 'rpid-mismatch' | 'user-presence-missing' | 'user-verification-missing' | 'bad-public-key' | 'bad-signature' | 'signature-invalid' | 'sign-count-regression';
/** The outcome of verifying one assertion. On success, the fresh counter to persist. */
export type StepUpVerifyResult = {
    readonly ok: true;
    readonly signCount: number;
} | {
    readonly ok: false;
    readonly reason: StepUpVerifyFailure;
};
interface ParsedAuthenticatorData {
    readonly rpIdHash: Uint8Array<ArrayBuffer>;
    readonly userPresent: boolean;
    readonly userVerified: boolean;
    readonly signCount: number;
}
/** Parse the fixed 37-byte prefix of authenticatorData (rpIdHash, flags, signCount). */
export declare function parseAuthenticatorData(bytes: Uint8Array<ArrayBuffer>): ParsedAuthenticatorData | null;
/**
 * Parse a COSE_Key (EC2 / P-256) into the raw 65-byte uncompressed EC point
 * (0x04 || x || y) Web Crypto's `importKey('raw', …)` accepts. Returns null if
 * the key is not a well-formed P-256 ES256 EC2 key.
 */
export declare function coseP256ToRawPoint(cose: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer> | null;
/**
 * Convert an ASN.1 DER ECDSA signature (SEQUENCE of two INTEGERs) into the raw
 * 64-byte r||s IEEE-P1363 form Web Crypto's ECDSA verify expects. Returns null
 * on a malformed structure.
 */
export declare function derToRawEcdsaSignature(der: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer> | null;
/**
 * Verify a WebAuthn assertion against a stored credential and the expected
 * challenge/rpId/origin. The full ceremony, in order: clientData type +
 * challenge + origin, rpIdHash, user-presence (always) and user-verification
 * (when required) flags, the ECDSA-P256 signature over
 * `authenticatorData || SHA-256(clientDataJSON)`, then the signature-counter
 * regression check. Any failure returns a specific reason; nothing partial ever
 * reads as a pass.
 */
export declare function verifyStepUpAssertion(params: StepUpVerifyParams): Promise<StepUpVerifyResult>;
export {};
//# sourceMappingURL=step-up-webauthn.d.ts.map