/**
 * WebAuthn/Passkey Authentication Service
 *
 * Core service for WebAuthn credential management and authentication.
 * Uses @simplewebauthn/server for cryptographic operations.
 *
 * Features:
 * - Passkey registration flow
 * - Passkey authentication flow
 * - Credential management (list, rename, delete)
 * - Replay attack prevention via counter verification
 * - Audit logging for all operations
 *
 * @packageDocumentation
 */
import { VorionError } from '../../common/errors.js';
import { type WebAuthnCredential, type WebAuthnConfig, type GenerateRegistrationOptionsInput, type RegistrationOptions, type VerifyRegistrationInput, type RegistrationResult, type GenerateAuthenticationOptionsInput, type AuthenticationOptions, type VerifyAuthenticationInput, type AuthenticationResult, type ListCredentialsInput, type RenameCredentialInput, type DeleteCredentialInput, RegistrationErrorCode, AuthenticationErrorCode } from './types.js';
import { type IWebAuthnStore } from './store.js';
/**
 * Base error class for WebAuthn operations
 */
export declare class WebAuthnError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * Error thrown when registration fails
 */
export declare class WebAuthnRegistrationError extends WebAuthnError {
    readonly errorCode: RegistrationErrorCode;
    code: string;
    statusCode: number;
    constructor(message: string, errorCode: RegistrationErrorCode, details?: Record<string, unknown>);
}
/**
 * Error thrown when authentication fails
 */
export declare class WebAuthnAuthenticationError extends WebAuthnError {
    readonly errorCode: AuthenticationErrorCode;
    code: string;
    statusCode: number;
    constructor(message: string, errorCode: AuthenticationErrorCode, details?: Record<string, unknown>);
}
/**
 * Audit logging interface
 */
export interface IAuditLogger {
    record(input: {
        tenantId: string;
        eventType: string;
        actor: {
            type: 'user' | 'agent' | 'service' | 'system';
            id: string;
            name?: string;
        };
        target: {
            type: string;
            id: string;
            name?: string;
        };
        action: string;
        outcome: 'success' | 'failure' | 'partial';
        reason?: string;
        metadata?: Record<string, unknown>;
    }): Promise<void>;
}
/**
 * WebAuthn Service Dependencies
 */
export interface WebAuthnServiceDependencies {
    /** WebAuthn store */
    store?: IWebAuthnStore;
    /** WebAuthn configuration */
    config?: Partial<WebAuthnConfig>;
    /** Audit logger */
    auditLogger?: IAuditLogger;
}
/**
 * WebAuthn Authentication Service
 */
export declare class WebAuthnService {
    private store;
    private config;
    private auditLogger?;
    constructor(deps?: WebAuthnServiceDependencies);
    /**
     * Generate registration options for a new passkey
     *
     * @param input - Registration options input
     * @returns Registration options to send to client
     */
    generateRegistrationOptions(input: GenerateRegistrationOptionsInput): Promise<RegistrationOptions>;
    /**
     * Verify registration response and store credential
     *
     * @param input - Registration verification input
     * @returns Registration result
     */
    verifyRegistration(input: VerifyRegistrationInput): Promise<RegistrationResult>;
    /**
     * Generate authentication options
     *
     * @param input - Authentication options input
     * @returns Authentication options to send to client
     */
    generateAuthenticationOptions(input: GenerateAuthenticationOptionsInput): Promise<AuthenticationOptions>;
    /**
     * Verify authentication response
     *
     * @param input - Authentication verification input
     * @returns Authentication result
     */
    verifyAuthentication(input: VerifyAuthenticationInput): Promise<AuthenticationResult>;
    /**
     * List user's credentials
     *
     * @param input - List credentials input
     * @returns Array of credentials
     */
    listCredentials(input: ListCredentialsInput): Promise<{
        credentials: WebAuthnCredential[];
        total: number;
    }>;
    /**
     * Rename a credential
     *
     * @param input - Rename credential input
     * @returns Updated credential
     */
    renameCredential(input: RenameCredentialInput): Promise<WebAuthnCredential>;
    /**
     * Delete a credential
     *
     * @param input - Delete credential input
     */
    deleteCredential(input: DeleteCredentialInput): Promise<void>;
    /**
     * Get credential count for a user
     */
    getCredentialCount(userId: string): Promise<number>;
    /**
     * Get challenge storage key
     */
    private getChallengeKey;
    /**
     * Generate a default credential name
     */
    private generateCredentialName;
    /**
     * Convert Uint8Array to base64url string
     */
    private uint8ArrayToBase64Url;
    /**
     * Convert base64url string to Uint8Array
     */
    private base64UrlToUint8Array;
    /**
     * Record an audit event
     */
    private audit;
    /**
     * Get service configuration
     */
    getConfig(): WebAuthnConfig;
}
/**
 * Get the WebAuthn service singleton
 */
export declare function getWebAuthnService(config?: Partial<WebAuthnConfig>): WebAuthnService;
/**
 * Create a new WebAuthn service instance
 */
export declare function createWebAuthnService(deps?: WebAuthnServiceDependencies): WebAuthnService;
/**
 * Reset the WebAuthn service singleton (for testing)
 */
export declare function resetWebAuthnService(): void;
//# sourceMappingURL=service.d.ts.map