/**
 * Cryptographic and derivation helpers for the Passkey Kit SDK.
 *
 * @packageDocumentation
 */
import type { RegistrationResponseJSON } from "@simplewebauthn/browser";
/**
 * Derive a smart-wallet contract address from a passkey credential id.
 *
 * The wallet's contract id is deterministic: `salt = sha256(keyId)` and the
 * deployer address salts a `ContractIdPreimageFromAddress`. This determinism is
 * load-bearing — the indexer reverse-lookup (keyId → wallet) re-derives the
 * address the same way — so this function is pinned with golden vectors in
 * `utils.test.ts`. Any change to the derivation breaks the tests instead of
 * silently shifting deployed addresses.
 *
 * @param keyId - The raw credential id bytes
 * @param deployerPublicKey - The deployer's `G…` public key
 * @param networkPassphrase - The network passphrase
 * @returns The derived contract address (`C…`)
 */
export declare function deriveContractAddress(keyId: Buffer, deployerPublicKey: string, networkPassphrase: string): string;
/**
 * Whether an uncompressed `0x04 || x || y` key is a point on the P-256 curve
 * (`y² ≡ x³ − 3x + b (mod p)`, coordinates in-field). A structurally valid but
 * off-curve key would register fine and deploy a wallet no signature can ever
 * satisfy, so extraction rejects it up front.
 */
export declare function isOnP256Curve(publicKey: Uint8Array): boolean;
/**
 * Extract the 65-byte uncompressed secp256r1 public key from a WebAuthn
 * registration (attestation) response.
 *
 * Tries, in order:
 * 1. `response.publicKey` when it is already a raw uncompressed EC point.
 * 2. `response.publicKey` decoded from SPKI via WebCrypto (`crypto.subtle`),
 *    which is the correct, non-magic-offset way to normalize the DER-encoded
 *    SubjectPublicKeyInfo most authenticators return.
 * 3. Parsing the COSE key out of `authenticatorData`, then
 *    `attestationObject` — with the COSE structure verified in place, never
 *    trusted fixed offsets.
 *
 * Whatever the source, the result must be a valid point ON the P-256 curve;
 * a mangled key is rejected here rather than deployed as an unusable wallet
 * signer.
 *
 * @throws {WebAuthnError} If no valid public key can be extracted.
 */
export declare function extractPublicKeyFromAttestation(response: RegistrationResponseJSON["response"]): Promise<Uint8Array>;
/**
 * Convert a DER-encoded ECDSA signature to Stellar's compact `r || s` form with
 * a low-S value (S <= n/2), as required by the secp256r1 host function.
 *
 * The DER structure is validated before any offset is dereferenced:
 * sequence/integer tags, short-form lengths that exactly span the buffer, and
 * `r`/`s` values in `[1, n-1]`. A WebAuthn P-256 signature always fits
 * short-form DER (total length < 128 bytes), so long-form lengths are rejected.
 *
 * @param derSignature - The DER-encoded signature
 * @returns 64-byte compact signature (`r || s`)
 * @throws {ValidationError} If the signature is not structurally valid DER or
 *   `r`/`s` are out of range for P-256.
 */
export declare function compactSignature(derSignature: Buffer): Uint8Array;
/**
 * Generate a cryptographically-random base64url challenge for a WebAuthn
 * ceremony.
 *
 * Replaces the old hard-coded `"stellaristhebetterblockchain"` challenge.
 */
export declare function generateChallenge(): string;
//# sourceMappingURL=utils.d.ts.map