/**
 * T5 · WebAuthn verification SEAM. The heavy attestation/assertion crypto + CBOR parsing is
 * delegated to a battle-tested verifier (production: `@simplewebauthn/server`, per the reuse rule)
 * INJECTED here, so the P5-owned security guards — single-use challenge, origin/rpId binding, and
 * signCount regression (cloned-authenticator signal) — stay dependency-light and deterministically
 * testable. INTEGRATION POINT: wire `@simplewebauthn/server` verifyRegistrationResponse /
 * verifyAuthenticationResponse into this interface at the P3/P6 boundary.
 */
export interface RegistrationOptions {
  readonly rpId: string
  readonly challenge: string
  readonly userId: string
  readonly timeoutMs: number
}
export interface AuthenticationOptions {
  readonly rpId: string
  readonly challenge: string
  readonly timeoutMs: number
}

/** Opaque authenticator responses (shape provided by the browser / @simplewebauthn). */
export interface RegistrationResponse {
  readonly clientChallenge: string
  readonly origin: string
  readonly rpId: string
}
export interface AuthenticationResponse {
  readonly clientChallenge: string
  readonly origin: string
  readonly rpId: string
  readonly credentialId: string
}

export interface RegistrationVerification {
  readonly verified: boolean
  readonly credentialId: string
  readonly publicKey: Uint8Array
  readonly signCount: number
  readonly transports: readonly string[]
}
export interface AuthenticationVerification {
  readonly verified: boolean
  readonly newSignCount: number
}

export interface WebAuthnVerifier {
  verifyRegistration(
    resp: RegistrationResponse,
    expectedChallenge: string,
    rpId: string,
    origin: string,
  ): Promise<RegistrationVerification>
  verifyAuthentication(
    resp: AuthenticationResponse,
    expectedChallenge: string,
    rpId: string,
    origin: string,
    credentialPublicKey: Uint8Array,
    expectedCredentialId: string,
    storedSignCount: number,
  ): Promise<AuthenticationVerification>
}

export class WebAuthnError extends Error {
  constructor(message: string) {
    super(message)
    this.name = 'WebAuthnError'
  }
}
