import type { PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, AuthenticationResponseJSON, AuthenticatorTransportFuture } from '@simplewebauthn/types';
/**
 * Authenticator transport types supported by WebAuthn
 */
export type AuthenticatorTransport = AuthenticatorTransportFuture;
/**
 * Configuration options for WebAuthn service
 */
export interface WebAuthnConfig {
    /** Relying Party name displayed to users during registration */
    rpName: string;
    /** Relying Party ID (domain), e.g., 'vorion.ai' */
    rpId: string;
    /** Full origin URL, e.g., 'https://vorion.ai' */
    origin: string;
    /** Attestation conveyance preference */
    attestation: 'none' | 'direct';
    /** User verification requirement */
    userVerification: 'required' | 'preferred' | 'discouraged';
    /** Timeout for WebAuthn operations in milliseconds */
    timeout: number;
}
/**
 * Represents a stored WebAuthn credential
 */
export interface WebAuthnCredential {
    /** Internal unique identifier */
    id: string;
    /** Base64URL encoded credential ID from authenticator */
    credentialId: string;
    /** Base64URL encoded public key */
    publicKey: string;
    /** Signature counter for replay attack prevention */
    counter: number;
    /** Type of device (e.g., 'singleDevice', 'multiDevice') */
    deviceType: string;
    /** Whether credential is backed up (e.g., iCloud Keychain) */
    backedUp: boolean;
    /** Supported transport methods */
    transports?: AuthenticatorTransport[];
    /** Timestamp when credential was created */
    createdAt: Date;
    /** Timestamp of last successful authentication */
    lastUsedAt?: Date;
    /** User-friendly name for the credential */
    name?: string;
}
/**
 * WebAuthn service for handling FIDO2 registration and authentication
 *
 * @example
 * ```typescript
 * const webauthn = getWebAuthnService({
 *   rpName: 'Vorion',
 *   rpId: 'vorion.ai',
 *   origin: 'https://vorion.ai'
 * });
 *
 * // Generate registration options
 * const options = await webauthn.generateRegistrationOpts(
 *   'user-123',
 *   'john@vorion.ai'
 * );
 *
 * // After user completes registration on client
 * const credential = await webauthn.verifyRegistration(
 *   'user-123',
 *   clientResponse,
 *   expectedChallenge
 * );
 * ```
 */
export declare class WebAuthnService {
    private readonly config;
    private readonly challengeStore;
    /**
     * Create a new WebAuthn service instance
     * @param config - Partial configuration (merged with defaults)
     */
    constructor(config?: Partial<WebAuthnConfig>);
    /**
     * Generate registration options for a new WebAuthn credential
     *
     * Creates the necessary options for the WebAuthn navigator.credentials.create() call.
     * Excludes any existing credentials to prevent duplicate registration.
     *
     * @param userId - Unique user identifier
     * @param userName - Human-readable user name (usually email)
     * @param existingCredentials - User's existing credentials to exclude
     * @returns PublicKeyCredentialCreationOptionsJSON for client-side registration
     *
     * @example
     * ```typescript
     * const options = await service.generateRegistrationOpts(
     *   'user-123',
     *   'john@vorion.ai',
     *   existingCredentials
     * );
     * // Send options to client for navigator.credentials.create()
     * ```
     */
    generateRegistrationOpts(userId: string, userName: string, existingCredentials?: WebAuthnCredential[]): Promise<PublicKeyCredentialCreationOptionsJSON>;
    /**
     * Verify a registration response from the client
     *
     * Validates the attestation and creates a new credential record.
     *
     * @param userId - User identifier (must match the one used in generateRegistrationOpts)
     * @param response - Registration response from navigator.credentials.create()
     * @param expectedChallenge - The challenge that was sent to the client
     * @returns The verified WebAuthn credential to store
     * @throws Error if verification fails
     *
     * @example
     * ```typescript
     * try {
     *   const credential = await service.verifyRegistration(
     *     'user-123',
     *     clientResponse,
     *     storedChallenge
     *   );
     *   // Save credential to database
     * } catch (error) {
     *   console.error('Registration failed:', error.message);
     * }
     * ```
     */
    verifyRegistration(userId: string, response: RegistrationResponseJSON, expectedChallenge: string): Promise<WebAuthnCredential>;
    /**
     * Generate authentication options for WebAuthn login
     *
     * Creates options for navigator.credentials.get() call.
     *
     * @param existingCredentials - User's registered credentials
     * @returns PublicKeyCredentialRequestOptionsJSON for client-side authentication
     *
     * @example
     * ```typescript
     * const options = await service.generateAuthenticationOpts(userCredentials);
     * // Send options to client for navigator.credentials.get()
     * ```
     */
    generateAuthenticationOpts(existingCredentials: WebAuthnCredential[]): Promise<PublicKeyCredentialRequestOptionsJSON>;
    /**
     * Verify an authentication response from the client
     *
     * Validates the assertion and checks the signature counter to prevent replay attacks.
     *
     * @param credential - The stored credential being used
     * @param response - Authentication response from navigator.credentials.get()
     * @param expectedChallenge - The challenge that was sent to the client
     * @returns Object containing verification status and new counter value
     * @throws Error if verification fails
     *
     * @example
     * ```typescript
     * const result = await service.verifyAuthentication(
     *   storedCredential,
     *   clientResponse,
     *   storedChallenge
     * );
     *
     * if (result.verified) {
     *   // Update credential counter in database
     *   credential.counter = result.newCounter;
     *   credential.lastUsedAt = new Date();
     * }
     * ```
     */
    verifyAuthentication(credential: WebAuthnCredential, response: AuthenticationResponseJSON, expectedChallenge: string): Promise<{
        verified: boolean;
        newCounter: number;
    }>;
    /**
     * Get a stored challenge for a user (consumes the challenge)
     * @param userId - User identifier
     * @returns The stored challenge or undefined if not found/expired
     */
    getStoredChallenge(userId: string): string | undefined;
    /**
     * Generate a unique credential ID
     */
    private generateCredentialId;
    /**
     * Convert Uint8Array to base64url string
     */
    private uint8ArrayToBase64Url;
    /**
     * Convert base64url string to Uint8Array
     */
    private base64UrlToUint8Array;
}
/**
 * Factory function to create a WebAuthn service instance
 *
 * @param config - Partial WebAuthn configuration (merged with defaults)
 * @returns Configured WebAuthnService instance
 *
 * @example
 * ```typescript
 * // Basic usage with defaults
 * const webauthn = getWebAuthnService();
 *
 * // Custom configuration
 * const webauthn = getWebAuthnService({
 *   rpName: 'My App',
 *   rpId: 'myapp.com',
 *   origin: 'https://myapp.com',
 *   userVerification: 'required',
 * });
 * ```
 */
export declare function getWebAuthnService(config?: Partial<WebAuthnConfig>): WebAuthnService;
export default WebAuthnService;
//# sourceMappingURL=webauthn.d.ts.map