export interface DeviceIdentity {
    deviceId: string;
    deviceSecret: string;
}
/**
 * Load the persisted device identity, or create and persist a new one.
 *
 * The same deviceSecret must be sent on every registration so the relay can map
 * a re-registering agent (after reboot or 24h session-code rotation) back to the
 * same saved machine.
 *
 * When `configDir` is provided (e.g. the desktop app's per-user data dir), the
 * identity is stored directly under it (`<configDir>/device.json`) and nothing
 * else is consulted. With AICOMMANDER_CONFIG_DIR set we store it under that
 * directory, but still ADOPT an identity left in the default locations by an
 * earlier install (see below). With neither, we try the primary (/etc) location
 * first, then fall back to the user config dir if /etc is not writable
 * (non-root / dev).
 *
 * Only the AICOMMANDER_CONFIG_DIR branch THROWS when the write fails; the other
 * two keep the documented best-effort behaviour and return an in-memory identity.
 */
export declare function loadOrCreateDevice(configDir?: string): DeviceIdentity;
/**
 * Mint and persist a BRAND-NEW device identity, overwriting any existing one.
 *
 * Recovery path for when the relay rejects the current identity (a 403 device
 * secret mismatch — e.g. a stale relay record whose secret no longer matches).
 * Retrying the same identity would 403 forever, so the agent regenerates once
 * and re-registers as a fresh device. The machine then appears as new on the
 * relay (any prior account/alias binding must be re-established).
 *
 * Crucially, we also remove any stale identity file in the NON-target directory.
 * `loadOrCreateDevice` reads PRIMARY first, then FALLBACK — so a lingering old
 * file in the directory we didn't write to could be read back on the next start,
 * resurrecting the rejected identity and re-entering the 403 loop. Removal is
 * best-effort (ENOENT / permission errors are ignored).
 *
 * That purge is load-bearing under AICOMMANDER_CONFIG_DIR too: the variable can
 * be absent on a later manual `run` (or any CLI subcommand), which would read the
 * rejected identity straight back out of /etc. An explicit `configDir` needs no
 * purge — the desktop process always passes it, so nothing else is ever read.
 *
 * EVERY purge is gated on a DURABLE write of the fresh identity. Deleting the
 * fallbacks after a write we never confirmed would leave the identity persisted
 * nowhere, and the next start would mint a third one — losing the stable session
 * code instead of recovering it.
 */
export declare function regenerateDevice(configDir?: string): DeviceIdentity;