export declare type AssertionOutcome = {
    readonly ok: true;
    readonly result: AssertionResult;
} | {
    readonly ok: false;
    readonly error: WebAuthnError;
};

export declare interface AssertionResult {
    /** The new signature counter to persist. */
    readonly newCounter: number;
}

export declare interface AssertionVerifyInput {
    readonly clientDataJSON: string;
    readonly authenticatorData: string;
    /** base64url signature over `authenticatorData ‖ sha256(clientDataJSON)`. */
    readonly signature: string;
    readonly expectedChallenge: string;
    readonly expectedOrigin: string;
    readonly rpId: string;
    /** The stored COSE public key (base64url) for the asserted credential. */
    readonly storedPublicKey: string;
    /** The stored signature counter for the credential. */
    readonly storedCounter: number;
}

/** Mint a fresh WebAuthn challenge (base64url, 32 random bytes). The
 *  server stashes it (keyed by user / ceremony) and hands it to the
 *  browser; `verifyRegistration` / `verifyAssertion` check it back. */
export declare const generateChallenge: () => string;

export declare type RegistrationOutcome = {
    readonly ok: true;
    readonly result: RegistrationResult;
} | {
    readonly ok: false;
    readonly error: WebAuthnError;
};

export declare interface RegistrationResult {
    /** base64url credential id to store. */
    readonly credentialId: string;
    /** base64url COSE public key to store. */
    readonly publicKey: string;
    /** Initial signature counter. */
    readonly counter: number;
}

export declare interface RegistrationVerifyInput {
    /** base64url clientDataJSON from `navigator.credentials.create`. */
    readonly clientDataJSON: string;
    /** base64url authenticatorData (or attestationObject's authData — see
     *  the client helper, which forwards the raw authenticatorData). */
    readonly authenticatorData: string;
    /** The challenge the server issued for this ceremony (base64url). */
    readonly expectedChallenge: string;
    /** The exact origin the ceremony must have run on (e.g.
     *  `https://app.example.com`). */
    readonly expectedOrigin: string;
    /** The relying-party id (registrable domain, e.g. `example.com`). */
    readonly rpId: string;
}

/** Verify a passkey assertion (sign-in). */
export declare const verifyAssertion: (input: AssertionVerifyInput) => AssertionOutcome;

/** Verify a passkey registration. Attestation is intentionally NOT
 *  checked (90% path); everything binding the credential to this
 *  origin/rpId IS. */
export declare const verifyRegistration: (input: RegistrationVerifyInput) => RegistrationOutcome;

export declare type WebAuthnError = 'bad-client-data' | 'wrong-type' | 'challenge-mismatch' | 'origin-mismatch' | 'rpid-mismatch' | 'user-not-present' | 'bad-auth-data' | 'no-credential' | 'unsupported-key' | 'bad-signature' | 'counter-replay';

export { }