/**
 * @module identity/device-delegate-helper
 *
 * Client-side helper functions for deriving, retrieving, persisting, and clearing local
 * cryptographic device delegate signing tokens ($S_D$) in IndexedDB.
 *
 * Applicable symmetrically to Sovereign, Custodial, and Hybrid identities.
 */
import { KeystoneIbGib_V1, DelegateKeystoneInfo } from "@ibgib/core-gib/dist/keystone/keystone-types.mjs";
import { KeystoneVerb } from "@ibgib/core-gib/dist/keystone/keystone-constants.mjs";
import { generateDefaultDeviceTag } from "../util/device-helper.mjs";
export { generateDefaultDeviceTag };
export declare const DEVICE_DELEGATE_SECRET_PREFIX = "ibgib_device_delegate_secret_";
export declare const DEVICE_AUTHOR_DELEGATE_SECRET_PREFIX = "ibgib_device_author_delegate_secret_";
/**
 * Builds the IndexedDB storage key for a device delegate secret given its delegate TJP address.
 */
export declare function getDeviceDelegateSecretKey({ delegateTjpAddr }: {
    delegateTjpAddr: string;
}): string;
/**
 * Builds the IndexedDB storage key for a device author delegate secret given its delegate TJP address.
 */
export declare function getDeviceAuthorDelegateSecretKey({ delegateTjpAddr }: {
    delegateTjpAddr: string;
}): string;
/**
 * Retrieves the stored device delegate secret for the given delegate TJP address,
 * checking in-memory cache first, then IndexedDB if present.
 */
export declare function getDeviceDelegateSecret({ delegateTjpAddr, }: {
    delegateTjpAddr: string;
}): Promise<string | undefined>;
/**
 * Persists a device delegate secret for the given delegate TJP address into memory and optionally IndexedDB.
 */
export declare function setDeviceDelegateSecret({ delegateTjpAddr, delegateSecret, persistToStorage, }: {
    delegateTjpAddr: string;
    delegateSecret: string;
    persistToStorage?: boolean;
}): Promise<void>;
/**
 * Retrieves an existing device delegate secret from IndexedDB, or generates a high-entropy 512-bit
 * secret, persists it, and returns it.
 */
export declare function getOrCreateDeviceDelegateSecret({ delegateTjpAddr, deviceTag, }: {
    delegateTjpAddr: string;
    deviceTag?: string;
}): Promise<string>;
/**
 * Retrieves the stored device author delegate secret for the given delegate TJP address,
 * checking in-memory cache first, then IndexedDB if present.
 * Falls back to checking generic device delegate secret.
 */
export declare function getDeviceAuthorDelegateSecret({ delegateTjpAddr, }: {
    delegateTjpAddr: string;
}): Promise<string | undefined>;
/**
 * Persists a device author delegate secret for the given delegate TJP address into memory and optionally IndexedDB.
 */
export declare function setDeviceAuthorDelegateSecret({ delegateTjpAddr, delegateSecret, persistToStorage, }: {
    delegateTjpAddr: string;
    delegateSecret: string;
    persistToStorage?: boolean;
}): Promise<void>;
/**
 * Removes the stored local device author delegate secret from memory and IndexedDB.
 */
export declare function clearDeviceAuthorDelegateSecret({ delegateTjpAddr, }: {
    delegateTjpAddr: string;
}): Promise<void>;
/**
 * Removes the stored local device delegate secret from memory and IndexedDB (both generic and author).
 */
export declare function clearDeviceDelegateSecret({ delegateTjpAddr, }: {
    delegateTjpAddr: string;
}): Promise<void>;
/**
 * Creates a Sovereign Password-based sync delegate for this device.
 * Standardized format: `pwd-${safeUsername}-${defaultDeviceTag}`
 */
export declare function createSovereignDeviceSyncDelegate({ username, primaryTjpAddr, masterSecret, metaspace, space, persistToStorage, }: {
    username: string;
    primaryTjpAddr: string;
    masterSecret: string;
    metaspace?: any;
    space?: any;
    persistToStorage?: boolean;
}): Promise<{
    delegateKeystone: any;
    deviceTag: string;
    delegateSecret: string;
}>;
/**
 * Creates an OAuth2 Custodial sync delegate for this device.
 * Standardized format: `oauth2-${providerId}-${defaultDeviceTag}`
 */
export declare function createOAuth2DeviceSyncDelegate({ providerId, username, primaryTjpAddr, custodianReqs, metaspace, space, }: {
    providerId: string;
    username?: string;
    primaryTjpAddr: string;
    custodianReqs?: any;
    metaspace?: any;
    space?: any;
}): Promise<{
    delegateKeystone: any;
    deviceTag: string;
    delegateSecret: string;
}>;
/**
 * Creates an Email Custodial sync delegate for this device.
 * Standardized format: `email-${safeUser}@${safeDomain}-${defaultDeviceTag}`
 */
export declare function createEmailDeviceSyncDelegate({ email, username: customUsername, primaryTjpAddr, custodianReqs, metaspace, space, }: {
    email: string;
    username?: string;
    primaryTjpAddr: string;
    custodianReqs?: any;
    metaspace?: any;
    space?: any;
}): Promise<{
    delegateKeystone: any;
    deviceTag: string;
    delegateSecret: string;
}>;
/**
 * Creates a Sovereign Password-based author delegate for this device.
 * Standardized format: `author-pwd-${safeUsername}-${defaultDeviceTag}`
 */
export declare function createSovereignDeviceAuthorDelegate({ username, primaryTjpAddr, masterSecret, metaspace, space, persistToStorage, }: {
    username: string;
    primaryTjpAddr: string;
    masterSecret: string;
    metaspace?: any;
    space?: any;
    persistToStorage?: boolean;
}): Promise<{
    delegateKeystone: any;
    deviceTag: string;
    delegateSecret: string;
}>;
/**
 * Creates an OAuth2 Custodial author delegate for this device.
 * Standardized format: `author-oauth2-${providerId}-${defaultDeviceTag}`
 */
export declare function createOAuth2DeviceAuthorDelegate({ providerId, username, primaryTjpAddr, metaspace, space, }: {
    providerId: string;
    username?: string;
    primaryTjpAddr: string;
    metaspace?: any;
    space?: any;
}): Promise<{
    delegateKeystone: any;
    deviceTag: string;
    delegateSecret: string;
}>;
/**
 * Creates an Email Custodial author delegate for this device.
 * Standardized format: `author-email-${emailTag}-${defaultDeviceTag}`
 */
export declare function createEmailDeviceAuthorDelegate({ email, username: customUsername, primaryTjpAddr, metaspace, space, }: {
    email: string;
    username?: string;
    primaryTjpAddr: string;
    metaspace?: any;
    space?: any;
}): Promise<{
    delegateKeystone: any;
    deviceTag: string;
    delegateSecret: string;
}>;
export interface GetThisDeviceDelegateParams {
    domainIdentity: KeystoneIbGib_V1;
    verb: KeystoneVerb | string;
    role?: string;
    metaspace: any;
    space: any;
}
export interface ThisDeviceDelegateResult {
    delegateKeystone: KeystoneIbGib_V1;
    delegateTjpAddr: string;
    delegateSecret: string;
    delegateInfo: DelegateKeystoneInfo;
}
/**
 * Resolves the active delegate keystone and secret for THIS device and verb.
 * Checks local space and IndexedDB to match the local device's registered delegate,
 * and cryptographically verifies that the stored secret satisfies the delegate's challenge pool.
 */
export declare function getThisDeviceDelegate(params: GetThisDeviceDelegateParams): Promise<ThisDeviceDelegateResult | undefined>;
//# sourceMappingURL=device-delegate-helper.d.mts.map