/**
 * WebAuthn `packed` attestation statement verifier (W3C WebAuthn §8.2).
 *
 * Verifies a JSON-native `cnf.attestation` envelope with
 * `format: "webauthn-packed"`. The statement carries:
 *
 * ```ts
 * {
 *   alg: number;          // COSE algorithm identifier
 *   sig: string;          // base64url signature
 *   x5c: string[];        // base64url DER chain, leaf-first
 *   ecdaaKeyId?: string;  // (deprecated) ECDAA path, rejected
 * }
 * ```
 *
 * Verification ordering, mirroring the Apple SE verifier and
 * `docs/subsystems/aauth_attestation.md`:
 *
 *   1. Parse the statement into a typed shape.
 *   2. Parse the `x5c` chain and confirm a valid leaf certificate.
 *   3. Optional AAGUID admission — when the leaf cert carries the FIDO
 *      `id-fido-gen-ce-aaguid` extension (OID 1.3.6.1.4.1.45724.1.1.4)
 *      AND the operator trust list (`webauthnAaguidAllowlist`) is
 *      non-empty, the extracted AAGUID MUST be in the list.
 *   4. Bind the leaf credential public key to `cnf.jwk` via RFC 7638
 *      thumbprint (constant-time).
 *   5. Walk the chain leaf→root and confirm the terminal certificate
 *      is rooted in the merged attestation trust set.
 *   6. Verify `sig` over `SHA-256(challenge || jkt)` using the leaf
 *      public key and the COSE-derived signing algorithm.
 *
 * Failure modes never throw; every input shape produces a structured
 * outcome so the AAuth middleware can record the diagnostic reason
 * without rejecting the request. Failed attestation cascades to the
 * operator-allowlist tier or `software` per the cascade rules.
 *
 * Out of scope (per FU-2026-Q3-aauth-webauthn-packed-verifier):
 *   - ECDAA path (deprecated by W3C). Statements carrying `ecdaaKeyId`
 *     are rejected with `signature_invalid` (the dispatcher reserves
 *     `unsupported_format` for unknown discriminators).
 *   - FIDO U2F attestation format (legacy register-only).
 *   - Anonymous-attestation paths that bypass the standard `x5c`
 *     chain. Those will surface as `chain_invalid` until a follow-up
 *     FU bundles the necessary roots.
 */
import type { AttestationContext, AttestationOutcome } from "./aauth_attestation_verifier.js";
/**
 * Verify a WebAuthn `packed` envelope. The dispatcher in
 * {@link verifyAttestation} guarantees that `envelope.format` is
 * `"webauthn-packed"`, the challenge precheck has already succeeded,
 * and the statement is a non-null object.
 */
export declare function verifyWebauthnPackedAttestation(envelope: {
    statement: unknown;
    challenge: string;
    format: string;
}, ctx: AttestationContext): Promise<AttestationOutcome>;
//# sourceMappingURL=aauth_attestation_webauthn_packed.d.ts.map