/**
 * Shared WebAuthn/passkey utilities used by passkey-enrollment, account-passkeys,
 * passkey-challenge, and conditional mediation on identifier/login screens.
 */
import { AuthenticationMethod } from "@authhero/adapter-interfaces";
import { Context } from "hono";
import type { Bindings, Variables } from "../../../types";
import type { WebAuthnCeremony, ScreenContext } from "./types";
export declare const PASSKEY_TYPES: readonly ["passkey", "webauthn-roaming", "webauthn-platform"];
/**
 * List the tenant-scoped passkey authentication methods for a given user.
 * Filters out non-passkey types and rows missing a credential_id.
 * Used by the challenge screen (to build allowCredentials) and by the login
 * screen (to gate the "Log in with passkey" link when the current tenant has
 * no matching credential for the known user).
 */
export declare function listTenantPasskeys(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, tenantId: string, userId: string): Promise<AuthenticationMethod[]>;
/**
 * Extract the RP ID from the host — strips port and uses the root domain.
 * Must use the actual request host (not custom_domain) because WebAuthn
 * requires rp.id to match the browser's current origin.
 */
export declare function getRpId(ctx: any): string;
/**
 * Get the origin URL for WebAuthn verification.
 * Must use the actual request host to match the browser's origin.
 */
export declare function getExpectedOrigin(ctx: any): string;
/**
 * Build the inline JavaScript that triggers navigator.credentials.create()
 * and auto-submits the form with the credential result.
 *
 * @param optionsJSON - JSON string of WebAuthn registration options
 * @param successAction - The action value to set on successful registration (default: "register")
 */
export declare function buildWebAuthnRegistrationScript(optionsJSON: string, successAction?: string): string;
/**
 * Build a structured WebAuthn ceremony object for the widget SPA flow.
 * The widget validates the shape and performs the ceremony natively
 * instead of executing arbitrary script content.
 *
 * @param optionsJSON - JSON string of WebAuthn registration options
 * @param successAction - The action value to set on successful registration (default: "register")
 */
export declare function buildWebAuthnCeremony(optionsJSON: string, successAction?: string): WebAuthnCeremony;
/**
 * Build the inline JavaScript that triggers navigator.credentials.get()
 * for passkey authentication (login) and auto-submits the form.
 *
 * @param optionsJSON - JSON string of WebAuthn authentication options
 * @param successAction - The action value to set on successful authentication (default: "authenticate")
 */
export declare function buildWebAuthnAuthenticationScript(optionsJSON: string, successAction?: string): string;
/**
 * Build a structured WebAuthn authentication ceremony object for the widget SPA flow.
 *
 * @param optionsJSON - JSON string of WebAuthn authentication options
 * @param successAction - The action value to set on successful authentication (default: "authenticate")
 */
export declare function buildWebAuthnAuthenticationCeremony(optionsJSON: string, successAction?: string): WebAuthnCeremony;
/**
 * Build a structured WebAuthn conditional mediation ceremony object for the widget SPA flow.
 * Conditional mediation shows passkey suggestions in the username field's autofill dropdown.
 *
 * @param optionsJSON - JSON string of WebAuthn authentication options
 * @param successAction - The action value to set on successful authentication (default: "passkey-authenticate")
 */
export declare function buildWebAuthnConditionalMediationCeremony(optionsJSON: string, successAction?: string): WebAuthnCeremony;
/**
 * Build inline JavaScript for conditional mediation (autofill-assisted passkeys).
 * This script runs on page load and silently offers passkey suggestions in the
 * username field's autofill dropdown via `navigator.credentials.get({ mediation: "conditional" })`.
 *
 * @param optionsJSON - JSON string of WebAuthn authentication options
 * @param successAction - The action value to set on successful authentication (default: "passkey-authenticate")
 */
export declare function buildConditionalMediationScript(optionsJSON: string, successAction?: string): string;
/**
 * Result type for passkey verification
 */
export type PasskeyVerificationResult = {
    success: true;
    user: any;
    primaryUser: any;
    loginSession: any;
    authConnection: string;
} | {
    success: false;
    error: string;
};
/**
 * Shared passkey authentication verification logic.
 * Used by both passkey-challenge screen (MFA) and identifier/login screens (conditional mediation).
 *
 * Verifies the WebAuthn assertion response, resolves the user, and updates session state.
 */
export declare function verifyPasskeyAuthentication(context: ScreenContext, credentialJson: string): Promise<PasskeyVerificationResult>;
