/**
 * The device's P-256 **ECDH** key used only to unwrap the account DEK.
 *
 * This key is per-device and non-syncable — losing the device loses only this convenience factor, not
 * the account (the passkey / recovery factors survive). Its public key goes into
 * the account's `cv:wd:<id>` on-chain envelope slot; the DEK is ECIES-wrapped to
 * it so daily unlock is silent.
 *
 * `LocalDeviceUnwrapKey` holds a raw scalar (Node / tests / React Native secure
 * storage). The browser implementation wraps a non-extractable WebCrypto ECDH
 * key and overrides `unwrap` with `deriveBits`; it never exposes the scalar.
 */
interface DeviceUnwrapKey {
    /** SEC1 *uncompressed* (65-byte) public key — the ECIES recipient key that is
     *  published on-chain in the device's envelope slot. */
    publicKeySec1(): Uint8Array;
    /** A short, stable id for this device's envelope slot (`cv:wd:<id>`). */
    slotId(): string;
    /** Unwrap the account DEK from this device's ECIES blob. */
    unwrap(blob: Uint8Array): Promise<Uint8Array>;
}
/** Raw-scalar device unwrap key (Node / React Native). */
declare class LocalDeviceUnwrapKey implements DeviceUnwrapKey {
    private readonly scalar;
    private constructor();
    /** Generate a fresh device unwrap key. */
    static generate(): LocalDeviceUnwrapKey;
    /** Rebuild from a persisted 32-byte scalar. */
    static fromScalar(scalar: Uint8Array): LocalDeviceUnwrapKey;
    /** The raw scalar, for the caller to persist in secure storage. */
    export(): Uint8Array;
    publicKeySec1(): Uint8Array;
    slotId(): string;
    unwrap(blob: Uint8Array): Promise<Uint8Array>;
}
/** Stable short slot id for a device's envelope entry: first 8 hex of
 *  `sha256(pubkey)`. Deterministic from the public key, so it's the same on
 *  every read and can't collide in practice for a handful of devices. */
declare function deviceSlotId(publicKeySec1: Uint8Array): string;

export { type DeviceUnwrapKey as D, LocalDeviceUnwrapKey as L, deviceSlotId as d };