@spec authenticate(Sigra.Config.t(), user :: map(), map(), keyword()) ::
  {:ok, Sigra.Passkeys.Credential.t()}
  | {:error, :credential_not_owned}
  | {:error, :sign_count_regression}
  | {:error, term()}

@spec config() :: Sigra.Config.t()

@spec count_for_user(Sigra.Config.t(), user :: map(), keyword()) :: non_neg_integer()

@spec delete(Sigra.Config.t(), user :: map(), credential_id :: binary(), keyword()) ::
  {:ok, Sigra.Passkeys.Credential.t()} | {:error, :not_found} | {:error, term()}

@spec known_transport?(String.t() | atom()) :: boolean()

@spec list_for_user(Sigra.Config.t(), user :: map(), keyword()) :: [
  Sigra.Passkeys.Credential.t()
]

@spec rate_limit_ceremony(
  Sigra.Config.t(),
  user_id :: term(),
  :registration | :authentication
) ::
  :ok | {:error, :rate_limited, %{retry_after_ms: pos_integer()}}

@spec register(Sigra.Config.t(), user :: map(), map(), keyword()) ::
  {:ok, Sigra.Passkeys.Credential.t()}
  | {:error, :passkey_cap_reached,
     %{count: non_neg_integer(), cap: pos_integer()}}
  | {:error, Ecto.Changeset.t()}
  | {:error, term()}

@spec rename(
  Sigra.Config.t(),
  user :: map(),
  credential_id :: binary(),
  new_nickname :: String.t(),
  keyword()
) ::
  {:ok, Sigra.Passkeys.Credential.t()}
  | {:error, :not_found}
  | {:error, Ecto.Changeset.t()}
  | {:error, term()}

@spec reset_cached_config() :: :ok