import * as Bytes from './Bytes.js';
import * as Errors from './Errors.js';
import * as Hex from './Hex.js';
import type { UnionOmit } from './internal/types.js';
import * as Authentication from '../webauthn/Authentication.js';
import type * as Credential from '../webauthn/Credential.js';
import * as Registration from '../webauthn/Registration.js';
import type * as Types from '../webauthn/Types.js';
export * from './WebAuthnP256.js';
/** Configuration for evaluating a WebAuthn credential-bound PRF. */
export type Prf = true | {
    /**
     * Application-owned PRF input.
     *
     * Use the same input to reproduce an output. Store unpredictable inputs
     * with the credential metadata.
     */
    input: Bytes.Bytes;
};
/**
 * Creates a WebAuthn credential and optionally returns its credential-bound
 * PRF output.
 *
 * @example
 * ```ts twoslash
 * import { Secp256k1, WebAuthn } from 'ox'
 *
 * const credential = await WebAuthn.createCredential({
 *   name: 'Example',
 *   prf: true
 * })
 * const privateKey = Secp256k1.fromPrf(credential.prf)
 * ```
 *
 * `prf: true` uses the stable input `ox.webauthn.prf.v1`. Pass
 * `{ input }` to use an application-owned input instead.
 *
 * When credential creation enables PRF but does not return an output, this
 * function performs a follow-up assertion. The user may be prompted twice.
 *
 * If PRF evaluation fails after registration, the thrown error retains the
 * created credential on its `credential` property.
 *
 * :::warning
 *
 * PRF output is secret application-held key material. Native
 * `credential.raw.toJSON()` output includes extension results, so do not
 * serialize or send the raw credential.
 *
 * PRF-derived keys are software keys. Code on any origin allowed to use the
 * same RP ID can request the same output after user verification.
 *
 * :::
 *
 * @param options - Credential creation and PRF options.
 * @returns The credential, with a copied PRF output when requested.
 */
export declare function createCredential<const options extends createCredential.Options | createCredential.PrfOptions>(options: options): Promise<createCredential.ReturnType<options>>;
export declare namespace createCredential {
    /** Options for ordinary WebAuthn P256 credential creation. */
    type Options = Registration.create.Options & {
        /** Reserved for credential creation with PRF output. */
        prf?: never;
    };
    /** Options for WebAuthn credential creation with required PRF output. */
    type PrfOptions = UnionOmit<Registration.getOptions.Options, 'authenticatorSelection' | 'challenge' | 'extensions'> & {
        /**
         * Criteria used to select an authenticator. User verification is always required.
         */
        authenticatorSelection?: Omit<NonNullable<Registration.getOptions.Options['authenticatorSelection']>, 'userVerification'> | undefined;
        /**
         * Cryptographic challenge. Defaults to a random 32-byte value.
         *
         * Supply and verify a server-generated challenge when registration is
         * also used to authenticate a user to a server.
         */
        challenge?: Registration.getOptions.Options['challenge'] | undefined;
        /** Function that creates the WebAuthn credential. */
        createFn?: ((options?: Types.CredentialCreationOptions) => Promise<Types.Credential | null>) | undefined;
        /** Additional WebAuthn extensions. The `prf` extension is managed by this function. */
        extensions?: Omit<Types.AuthenticationExtensionsClientInputs, 'prf'> | undefined;
        /** Function used for a follow-up PRF assertion when creation does not return an output. */
        getFn?: ((options?: Types.CredentialRequestOptions) => Promise<Types.Credential | null>) | undefined;
        /** Credential-bound PRF configuration. */
        prf: Prf;
        /** Raw credential options cannot be combined with managed PRF evaluation. */
        publicKey?: never;
    };
    /** Created WebAuthn credential with its credential-bound PRF output. */
    type PrfReturnType = Credential.Credential & {
        /** Copied 32-byte credential-bound PRF output. */
        prf: Bytes.Bytes;
    };
    /** Return type for a WebAuthn credential creation request. */
    type ReturnType<options extends Options | PrfOptions> = options extends PrfOptions ? PrfReturnType : Credential.Credential;
    type ErrorType = InvalidExtensionError | InvalidOptionsError | InvalidPrfOutputError | PrfEvaluationFailedError | PrfNotSupportedError | Registration.create.ErrorType | Errors.GlobalErrorType;
}
/**
 * Requests a WebAuthn credential and returns its credential-bound PRF output.
 *
 * @example
 * ```ts twoslash
 * import { Secp256k1, WebAuthn } from 'ox'
 *
 * const { prf } = await WebAuthn.getCredential({
 *   credentialId: 'oZ48...',
 *   prf: true
 * })
 * const privateKey = Secp256k1.fromPrf(prf)
 * ```
 *
 * `prf: true` uses the stable input `ox.webauthn.prf.v1`. Pass
 * `{ input }` to use an application-owned input instead.
 *
 * When more than one credential can be selected, check `result.id`
 * before using the PRF output.
 *
 * :::warning
 *
 * PRF output is secret application-held key material. Native
 * `response.raw.toJSON()` output includes extension results, so do not
 * serialize or send the raw response.
 *
 * :::
 *
 * @param options - Credential request and PRF options.
 * @returns The requested credential and a copied 32-byte PRF output.
 */
export declare function getCredential(options: getCredential.Options): Promise<getCredential.ReturnType>;
export declare namespace getCredential {
    type Options = UnionOmit<Authentication.getOptions.Options, 'challenge' | 'extensions' | 'userVerification'> & {
        /**
         * Challenge to sign. Defaults to a random 32-byte value.
         *
         * Supply and verify a server-generated challenge when the assertion is
         * also used to authenticate a user to a server.
         */
        challenge?: Hex.Hex | undefined;
        /** Additional WebAuthn extensions. The `prf` extension is managed by this function. */
        extensions?: Omit<Types.AuthenticationExtensionsClientInputs, 'prf'> | undefined;
        /** Function that requests the WebAuthn credential. */
        getFn?: ((options?: Types.CredentialRequestOptions) => Promise<Types.Credential | null>) | undefined;
        /** Credential-bound PRF configuration. */
        prf: Prf;
        /** Raw credential options cannot be combined with managed PRF evaluation. */
        publicKey?: never;
    };
    /** Result from a WebAuthn credential request. */
    type Response = {
        /** Credential identifier. */
        id: string;
        /** Native WebAuthn credential. */
        raw: Types.PublicKeyCredential;
    };
    type ReturnType = Response & {
        /** Copied 32-byte credential-bound PRF output. */
        prf: Bytes.Bytes;
    };
    type ErrorType = Authentication.getOptions.ErrorType | GetCredentialFailedError | InvalidExtensionError | InvalidOptionsError | InvalidPrfOutputError | PrfEvaluationFailedError | PrfUnavailableError | Errors.GlobalErrorType;
}
type PrfResultContext = {
    credential?: Credential.Credential | undefined;
    response?: getCredential.Response | undefined;
};
/** Thrown when a caller supplies the managed `prf` extension. */
export declare class InvalidExtensionError extends Errors.BaseError {
    readonly name = "WebAuthn.InvalidExtensionError";
    constructor();
}
/** Thrown when raw credential options are combined with managed PRF evaluation. */
export declare class InvalidOptionsError extends Errors.BaseError {
    readonly name = "WebAuthn.InvalidOptionsError";
    constructor();
}
/** Thrown when a WebAuthn PRF result is not a valid 32-byte output. */
export declare class InvalidPrfOutputError extends Errors.BaseError {
    /** Credential that returned the invalid PRF output, when created in this operation. */
    readonly credential?: Credential.Credential | undefined;
    /** Authentication response that returned the invalid PRF output, when available. */
    readonly response?: getCredential.Response | undefined;
    readonly name = "WebAuthn.InvalidPrfOutputError";
    constructor({ credential, response, size, }: PrfResultContext & {
        size?: number | undefined;
    });
}
/** Thrown when a created credential does not support PRF evaluation. */
export declare class PrfNotSupportedError extends Errors.BaseError {
    /** Credential that was created before PRF support was determined. */
    readonly credential: Credential.Credential;
    readonly name = "WebAuthn.PrfNotSupportedError";
    constructor({ credential }: {
        credential: Credential.Credential;
    });
}
/** Thrown when a credential assertion does not return a PRF output. */
export declare class PrfUnavailableError extends Errors.BaseError {
    /** Authentication response that did not contain a PRF output. */
    readonly response: getCredential.Response;
    readonly name = "WebAuthn.PrfUnavailableError";
    constructor({ response }: {
        response: getCredential.Response;
    });
}
/** Thrown when WebAuthn PRF evaluation fails after a credential ceremony. */
export declare class PrfEvaluationFailedError extends Errors.BaseError<Error> {
    /** Credential that was created before PRF evaluation failed, when available. */
    readonly credential?: Credential.Credential | undefined;
    /** Authentication response produced before PRF evaluation failed, when available. */
    readonly response?: getCredential.Response | undefined;
    readonly name = "WebAuthn.PrfEvaluationFailedError";
    constructor({ cause, credential, response, }: {
        cause: Error;
        credential?: Credential.Credential | undefined;
        response?: getCredential.Response | undefined;
    });
}
/** Thrown when a WebAuthn credential request fails. */
export declare class GetCredentialFailedError extends Errors.BaseError<Error> {
    readonly name = "WebAuthn.GetCredentialFailedError";
    constructor({ cause }?: {
        cause?: Error | undefined;
    });
}
//# sourceMappingURL=WebAuthn.d.ts.map