import crypto from 'node:crypto';
import type { GatewayScope } from '../../gateway/security/gateway-scopes.js';
export type DevicePlatform = 'ios' | 'android';
export type DevicePublicKeyJwk = crypto.webcrypto.JsonWebKey;
export type DeviceRecord = {
    id: string;
    displayName: string;
    platform: DevicePlatform;
    publicKeyJwk: DevicePublicKeyJwk;
    scopes: GatewayScope[];
    createdAt: number;
    lastSeenAt?: number;
    revokedAt?: number;
};
export type DeviceAccessIdentity = {
    deviceId: string;
    accessSessionId: string;
    scopes: GatewayScope[];
};
export type DeviceTokenPair = {
    accessToken: string;
    accessTokenExpiresAt: number;
    refreshToken: string;
    refreshTokenExpiresAt: number;
};
export declare function createDevice(input: {
    id?: string;
    displayName: string;
    platform: DevicePlatform;
    publicKeyJwk: DevicePublicKeyJwk;
    scopes: readonly GatewayScope[];
    now?: number;
}): DeviceRecord;
export declare function getDevice(deviceId: string): DeviceRecord | undefined;
export declare function listDevices(): DeviceRecord[];
export declare function issueDeviceTokenPair(deviceId: string, now?: number): DeviceTokenPair;
/** Registers a phone-generated bootstrap credential without persisting its secret. */
export declare function registerInitialDeviceRefreshToken(deviceId: string, token: string, now?: number): number;
export declare function authenticateDeviceAccessToken(token: string, now?: number): DeviceAccessIdentity | undefined;
export declare function buildRefreshProofMessage(input: {
    credentialId: string;
    timestamp: number;
    nonce: string;
    requestId: string;
    nextRefreshToken: string;
}): string;
export declare function rotateDeviceRefreshToken(input: {
    refreshToken: string;
    timestamp: number;
    nonce: string;
    requestId: string;
    nextRefreshToken: string;
    signature: string;
    now?: number;
}): DeviceTokenPair;
export declare function revokeDevice(deviceId: string, now?: number): boolean;