import { i as CoordinationGatewayGrantRequest, j as CoordinationGatewayGrant } from './ITransport-yaruAmx3.js';
import { A as AttestationProvider, a as AuthProvider, B as BotVerificationProvider, e as DeviceProfile, O as Options, C as Client } from './types-C4TIUgOJ.js';
import { P as PlutoIpcBridge } from './ipc-CPnNwv6f.js';
import './coreClient.js';
import './assembly-BTzwQuwI.js';
import './types-D67HlF0p.js';
import './capabilities-BwzPe51I.js';

interface DeviceProof {
    publicKeyJwk: JsonWebKey;
    signature: string;
    nonce: string;
    issuedAt: number;
}
interface DeviceKey {
    readonly publicKeyJwk: JsonWebKey;
    readonly thumbprint: string;
    proof(challenge: (nonce: string, issuedAt: number) => string): Promise<DeviceProof>;
}
interface DeviceKeyProvider {
    getOrCreate(appTag: string): Promise<DeviceKey>;
    delete?(appTag: string): Promise<void>;
    /**
     * Optional platform-secure record storage. Native hosts use this for the
     * device certificate that is bound to the private key; browsers retain
     * their same-origin localStorage implementation.
     */
    readSecureRecord?(appTag: string, key: string): Promise<string | null>;
    writeSecureRecord?(appTag: string, key: string, value: string): Promise<void>;
    deleteSecureRecord?(appTag: string, key: string): Promise<void>;
}

interface Endpoints {
    controlPlane: string;
    gateway: string;
}

interface CredentialSource {
    type: 'capability' | 'device-certificate';
    token: string;
    avenue: CoordinationGatewayGrantRequest['avenue'];
    expiresAtMs: number;
    renew?: () => Promise<CredentialSource>;
    /**
     * Re-establishes an authenticated device certificate only after the
     * control plane explicitly reports a stale generation. This is separate
     * from time-based renewal so revocation cannot create a refresh loop.
     */
    recoverRejectedCertificate?: () => Promise<CredentialSource>;
}
interface CachedDeviceCertificate {
    token: string;
    expiresAtMs: number;
    principalId?: string;
    signingPublicJwk: JsonWebKey & {
        kid?: string;
    };
}
interface AuthenticatedDeviceCertificate extends CachedDeviceCertificate {
    principalId: string;
    enrolled: boolean;
}
interface ControlPlaneEvents {
    beforeLogicalOperation?: (operation: string) => void;
    onLogicalOperation?: (operation: string) => void;
    onAuthEpochChanged?: (auth: AuthProvider) => void;
}
declare class ControlPlane {
    readonly apiKey: string;
    private readonly endpoints;
    private readonly keyProvider;
    private readonly attestation?;
    private readonly events;
    private readonly botVerification?;
    readonly appTag: string;
    private keyPromise;
    private readonly authEpochs;
    constructor(apiKey: string, endpoints: Endpoints, keyProvider: DeviceKeyProvider, attestation?: AttestationProvider | undefined, events?: ControlPlaneEvents, botVerification?: BotVerificationProvider | undefined);
    private record;
    private before;
    private authEpoch;
    dispose(): void;
    private key;
    private post;
    capability(kind: 'space' | 'room' | 'ticket', id: string, maxPeers?: number, advancedFanout?: boolean): Promise<CredentialSource>;
    deviceCertificate(auth: AuthProvider, deviceId: string, avenue?: CoordinationGatewayGrantRequest['avenue'], profile?: DeviceProfile, rejected?: AuthenticatedDeviceCertificate): Promise<{
        source: CredentialSource;
        principalId: string;
        enrolled: boolean;
    }>;
    private resolveAuthenticatedDevice;
    private deviceCertificateResult;
    private enrollAuthenticatedDevice;
    listEnrolledDevices(auth: AuthProvider, deviceId: string): Promise<Array<{
        deviceId: string;
        name?: string;
        platform?: string;
        enrolledAtMs: number | null;
        lastGrantAtMs: number | null;
        current: boolean;
    }>>;
    revokeDevice(auth: AuthProvider, currentDeviceId: string, targetDeviceId: string): Promise<void>;
    revokeAllDevices(auth: AuthProvider, currentDeviceId: string, exceptCurrent: boolean): Promise<void>;
    private deleteDeviceKey;
    private deviceManagement;
    durableRoomMembership(source: CredentialSource, roomId: string, action: 'join' | 'leave'): Promise<void>;
    grantProvider(source: CredentialSource, input?: {
        maxPeers?: number;
        features?: Record<string, boolean>;
        deviceProfile?: Pick<DeviceProfile, 'name' | 'platform'>;
        /**
         * Keeps the transport/admission credential relay synchronized
         * when a capability or device certificate is renewed in place.
         * The callback runs only after the replacement source has
         * successfully produced a gateway grant.
         */
        onSourceRenewed?: (source: {
            token: string;
            expiresAtMs: number;
        }) => Promise<void> | void;
    }): (request: CoordinationGatewayGrantRequest) => Promise<CoordinationGatewayGrant>;
}

/** Focused control-plane factory for live harnesses that do not need a transport runtime. */
declare function controlPlane(apiKey: string, endpoints: Endpoints, keyNamespace: string): ControlPlane;
declare function OpenRTC(options: Options, endpoints: Endpoints, testing?: {
    deviceId?: string;
    irohTestRelayUrl?: string;
}): Client;
declare namespace OpenRTC {
    var native: (options: Options, endpoints: Endpoints, bridge: PlutoIpcBridge) => Client;
}

export { OpenRTC, controlPlane };