import { Identity, Recipient } from "./index.js";
import { Stanza } from "./format.js";
/**
 * Options for {@link createCredential}.
 */
export interface CreationOptions {
    /**
     * The name of the key. This will be shown in various platform UIs.
     *
     * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialCreationOptions#name_2 | PublicKeyCredentialCreationOptions.user.name}
     */
    keyName: string;
    /**
     * The type of credential to create.
     *
     * If the default `passkey` is used, the credential will be required to be
     * discoverable. This means that the user will be able to select it from a
     * list of credentials even if {@link Options.identity} is not set.
     *
     * If `security-key` is used, the `security-key` hint and the `discouraged`
     * residentKey option will be passed to the authenticator. The returned
     * identity string MUST be passed with {@link Options.identity} to encrypt
     * and decrypt files, and CAN'T be regenerated if lost. The UI will prompt
     * the user to use a hardware token. The returned identity might also be
     * usable with age-plugin-fido2prf outside the browser.
     *
     * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialCreationOptions#residentkey | PublicKeyCredentialCreationOptions.authenticatorSelection.residentKey}
     * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialCreationOptions#hints | PublicKeyCredentialCreationOptions.hints}
     */
    type?: "passkey" | "security-key";
    /**
     * The relying party ID to use for the WebAuthn credential.
     *
     * This must be the origin's domain (e.g. `app.example.com`), or a parent
     * (e.g. `example.com`). Note that credentials are available to subdomains
     * of the RP ID, but not to parents, so it's important to choose the right
     * RP ID.
     *
     * @see {@link https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html#relying-party-ids | A Tour of WebAuthn § Relying party IDs}
     * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialCreationOptions#id_2 | PublicKeyCredentialCreationOptions.rp.id}
     */
    rpId?: string;
}
declare global {
    interface PublicKeyCredentialCreationOptions {
        hints?: ("security-key" | "client-device" | "hybrid")[];
    }
    interface PublicKeyCredentialRequestOptions {
        hints?: ("security-key" | "client-device" | "hybrid")[];
    }
}
/**
 * Creates a new WebAuthn credential which can be used for encryption and
 * decryption.
 *
 * @returns The identity string to use for encryption or decryption.
 *
 * This string begins with `AGE-PLUGIN-FIDO2PRF-1...` and encodes the credential ID,
 * the relying party ID, and the transport hint.
 *
 * If the credential was created with {@link CreationOptions."type"} set to the
 * default `passkey`, this string is mostly a hint to make selecting the
 * credential easier. If the credential was created with `security-key`, this
 * string is required to encrypt and decrypt files, and can't be regenerated if
 * lost.
 *
 * @see {@link Options.identity}
 * @experimental
 */
export declare function createCredential(options: CreationOptions): Promise<string>;
/**
 * Options for {@link WebAuthnRecipient} and {@link WebAuthnIdentity}.
 */
export interface Options {
    /**
     * The identity string to use for encryption or decryption.
     *
     * If set, the file will be encrypted or decrypted with this specific
     * credential. Otherwise, the user will be prompted to select a discoverable
     * credential from those available for the RP (which might include login
     * credentials, which won't work).
     *
     * @see {@link createCredential}
     */
    identity?: string;
    /**
     * The relying party ID for discoverable credentials. Ignored if
     * {@link identity} is set, as the RP ID is parsed from the identity.
     *
     * @see {@link CreationOptions.rpId}
     * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredentialRequestOptions#rpid | PublicKeyCredentialRequestOptions.rpId}
     */
    rpId?: string;
}
declare class WebAuthnInternal {
    private credId;
    private transports;
    private rpId;
    constructor(options?: Options);
    protected getCredential(nonce: Uint8Array): Promise<AuthenticationExtensionsPRFValues>;
}
/**
 * A {@link Recipient} that symmetrically encrypts file keys using a WebAuthn
 * credential, such as a passkey or a security key.
 *
 * The credential needs to already exist, and support the PRF extension.
 * Usually, it would have been created with {@link createCredential}.
 *
 * @see {@link Encrypter.addRecipient}
 * @experimental
 */
export declare class WebAuthnRecipient extends WebAuthnInternal implements Recipient {
    /**
     * Implements {@link Recipient.wrapFileKey}.
     */
    wrapFileKey(fileKey: Uint8Array): Promise<Stanza[]>;
}
/**
 * An {@link Identity} that symmetrically decrypts file keys using a WebAuthn
 * credential, such as a passkey or a security key.
 *
 * The credential needs to already exist, and support the PRF extension.
 * Usually, it would have been created with {@link createCredential}.
 *
 * @see {@link Decrypter.addIdentity}
 * @experimental
 */
export declare class WebAuthnIdentity extends WebAuthnInternal implements Identity {
    /**
     * Implements {@link Identity.unwrapFileKey}.
     */
    unwrapFileKey(stanzas: Stanza[]): Promise<Uint8Array | null>;
}
export {};