import type { MemberKeyBundleV1 } from './member-bundle';
import { type Bytes } from './primitives';
export declare const PAIRING_VERIFICATION_SECRET_BYTES = 16;
export declare const PAIRING_VERIFICATION_TEXT_LENGTH = 26;
/** 128 fresh CSPRNG bits. */
export declare function generatePairingVerificationSecret(): Bytes;
export declare function encodePairingVerificationSecret(pv: Uint8Array): string;
export declare function decodePairingVerificationSecret(text: string): Bytes;
/** `<pairingCode>.<pv>`, the string the client shows and the user gives to the device. */
export declare function formatPairingInput(pairingCode: string, pv: Uint8Array): string;
export interface PairingInput {
    /** The only part the device sends to the Host. */
    readonly pairingCode: string;
    /** Kept on the device; never sent to the Host. */
    readonly pv: Bytes;
}
/** Split `<pairingCode>.<pv>` on the last `.`. Both parts are required. */
export declare function parsePairingInput(text: string): PairingInput;
/** Domain tag of the MAC the device sends: step 3, `HMAC(pv, device bundle, tenantId, deviceId)`. */
export declare const DEVICE_PAIRING_MAC_DOMAIN = "byok-pairing-device-mac-v1\n";
/** Domain tag of the MAC the client sends: step 4, `HMAC(pv, client bundle, chain head)`. */
export declare const CLIENT_PAIRING_MAC_DOMAIN = "byok-pairing-client-mac-v1\n";
export interface DevicePairingMacInput {
    readonly tenantId: string;
    readonly deviceId: string;
    /** The device's own bundle. Its `deviceId` must equal `deviceId`. */
    readonly member: MemberKeyBundleV1;
}
export interface ClientPairingMacInput {
    /** The client's own bundle. A client bundle has no `deviceId`. */
    readonly member: MemberKeyBundleV1;
    /** The chain head after the client signed `add(device)`. */
    readonly chainHead: {
        readonly seq: number;
        readonly hash: string;
    };
}
export declare function computeDevicePairingMac(pv: Uint8Array, input: DevicePairingMacInput): Promise<string>;
export declare function computeClientPairingMac(pv: Uint8Array, input: ClientPairingMacInput): Promise<string>;
/**
 * Check a received device MAC. Parse the received bundle with
 * `parseMemberKeyBundle` first. Returns `false` for a wrong or malformed MAC,
 * or a bundle that does not name `deviceId`. Only a malformed `pv` throws.
 */
export declare function verifyDevicePairingMac(pv: Uint8Array, input: DevicePairingMacInput, mac: unknown): Promise<boolean>;
/**
 * Check a received client MAC. Parse the received bundle with
 * `parseMemberKeyBundle` first. Returns `false` for a wrong or malformed MAC,
 * a device bundle, or a malformed chain head. Only a malformed `pv` throws.
 */
export declare function verifyClientPairingMac(pv: Uint8Array, input: ClientPairingMacInput, mac: unknown): Promise<boolean>;