/**
 * Device Provisioning Service for the BrightChain identity system.
 *
 * Handles the complete device provisioning workflow: validating a paper key,
 * recovering the member identity, generating device-specific keys via BIP32
 * hierarchical deterministic derivation, and persisting device metadata
 * through a platform-independent storage interface.
 *
 * Device keys are derived using the BIP32 path `m/44'/60'/0'/1/<deviceIndex>`
 * where `deviceIndex` is a monotonically increasing counter per member. This
 * keeps device keys deterministic (reproducible from the same mnemonic) while
 * ensuring each device gets a unique key pair.
 *
 * Requirements: 3.1, 3.2, 3.3, 3.4
 */
import { ECIESService, Member, PlatformID } from '@digitaldefiance/ecies-lib';
import { DeviceType } from '../../enumerations/deviceType';
import { IDeviceMetadata } from '../../interfaces/identity/device';
import { IDeviceKeyStorage } from '../../interfaces/identity/deviceKeyStorage';
/**
 * Error thrown when a paper key fails validation during device provisioning.
 */
export declare class InvalidPaperKeyError extends Error {
    constructor(message?: string);
}
/**
 * Error thrown when device key generation fails.
 */
export declare class DeviceKeyGenerationError extends Error {
    constructor(message: string);
}
/**
 * Error thrown when device key storage fails.
 */
export declare class DeviceKeyStorageError extends Error {
    constructor(message: string);
}
/**
 * Result of device key generation containing the derived key pair
 * and the public key in hex format for storage in device metadata.
 */
export interface IDeviceKeyResult {
    /** Compressed SECP256k1 public key (33 bytes) */
    publicKey: Uint8Array;
    /** Compressed SECP256k1 public key as hex string */
    publicKeyHex: string;
    /** BIP32 derivation path used to derive this key */
    derivationPath: string;
    /** The device index used in the derivation path */
    deviceIndex: number;
}
/**
 * Full result of a successful device provisioning operation.
 */
export interface IProvisioningResult<TID extends PlatformID = Uint8Array> {
    /** The provisioned device metadata */
    deviceMetadata: IDeviceMetadata;
    /** The recovered member identity */
    member: Member<TID>;
    /** The derived device key information */
    deviceKeys: IDeviceKeyResult;
}
/**
 * Service for provisioning new devices on a BrightChain member account.
 *
 * The provisioning flow:
 * 1. Validate the paper key (Requirement 3.1)
 * 2. Recover the member identity from the paper key (Requirement 3.2)
 * 3. Generate device-specific keys via BIP32 derivation (Requirement 3.3)
 * 4. Store device metadata in platform-independent storage (Requirement 3.4)
 *
 * All methods are static — the service is stateless and safe to call
 * from any context (browser or Node.js).
 *
 * @example
 * ```typescript
 * const eciesService = ServiceProvider.getInstance().eciesService;
 * const storage = new InMemoryDeviceKeyStorage();
 *
 * const result = await DeviceProvisioningService.provisionDevice(
 *   'abandon abandon abandon ... about',
 *   'Work Laptop',
 *   DeviceType.DESKTOP,
 *   eciesService,
 *   storage,
 *   0,
 * );
 *
 * console.log(result.deviceMetadata.publicKey); // hex-encoded public key
 * console.log(result.member.name);              // 'Recovered User'
 * ```
 */
export declare class DeviceProvisioningService {
    /**
     * Provision a new device using a paper key.
     *
     * Performs the complete provisioning workflow: validates the paper key,
     * recovers the member identity, generates device-specific keys, and
     * stores the device metadata.
     *
     * **Validates: Requirements 3.1, 3.2, 3.3, 3.4**
     *
     * @param paperKey     - The 24-word BIP39 mnemonic paper key
     * @param deviceName   - Human-readable name for the device (e.g. "Work Laptop")
     * @param deviceType   - Category of the device (desktop, mobile, web)
     * @param eciesService - The ECIES service instance for key operations
     * @param storage      - Platform-independent device key storage
     * @param deviceIndex  - The BIP32 child index for this device (0-based)
     * @returns A promise resolving to the full provisioning result
     * @throws {InvalidPaperKeyError} If the paper key is invalid
     * @throws {DeviceKeyGenerationError} If key derivation fails
     * @throws {DeviceKeyStorageError} If storage fails
     */
    static provisionDevice<TID extends PlatformID = Uint8Array>(paperKey: string, deviceName: string, deviceType: DeviceType, eciesService: ECIESService<TID>, storage: IDeviceKeyStorage, deviceIndex: number): Promise<IProvisioningResult<TID>>;
    /**
     * Generate device-specific keys from a paper key mnemonic using BIP32
     * hierarchical deterministic derivation.
     *
     * The derivation path is `m/44'/60'/0'/1/<deviceIndex>` where the
     * `change=1` branch is reserved for device keys (as opposed to
     * `change=0` which is used for external wallet addresses).
     *
     * **Validates: Requirement 3.3** — Generate device-specific keys derived
     * from member identity
     *
     * @param paperKey    - The 24-word BIP39 mnemonic
     * @param deviceIndex - The child index for this device (0-based, non-hardened)
     * @returns The derived device key result
     * @throws {DeviceKeyGenerationError} If BIP32 derivation fails
     */
    static generateDeviceKeys(paperKey: string, deviceIndex: number): IDeviceKeyResult;
    /**
     * Store device metadata in the provided platform-independent storage.
     *
     * This method wraps the storage call with error handling to produce
     * a consistent {@link DeviceKeyStorageError} on failure.
     *
     * **Validates: Requirement 3.4** — Store device keys in local secure storage
     *
     * @param deviceMetadata - The device metadata to persist
     * @param storage        - The platform-independent storage implementation
     * @throws {DeviceKeyStorageError} If the storage operation fails
     */
    static storeDeviceKeys(deviceMetadata: IDeviceMetadata, storage: IDeviceKeyStorage): Promise<void>;
}
//# sourceMappingURL=deviceProvisioningService.d.ts.map