import { normalizeRestorationBootstrapRequest, type NativeRestorationBootstrapIdentity } from '../backend-contract/restoration.js';
/** Opaque identity returned by the trusted native host during restoration bootstrap. */
export interface RestorationHostIdentity extends NativeRestorationBootstrapIdentity {
    readonly kind: 'restoration';
}
export interface EphemeralHostIdentity {
    readonly kind: 'ephemeral';
    readonly attachmentNonce: string;
    readonly managerNonce: string;
    readonly operationNonce: string;
}
export interface EphemeralIdentityInput {
    readonly now?: () => number;
    readonly randomBytes?: (length: number) => Uint8Array;
}
/**
 * The native host is the only restoration derivation authority. This retained
 * advanced symbol is intentionally fail-closed so JavaScript cannot forge a
 * restoration identity from caller-authored application data.
 */
export declare function deriveRestorationIdentity(_input: {
    readonly applicationId: string;
    readonly restorationId: string;
    readonly generation?: string;
}): never;
export declare function createEphemeralHostIdentity(input?: EphemeralIdentityInput): EphemeralHostIdentity;
export interface BleManagerCreateOptions {
    /** Optional app-declared stable name for an intentionally distinct manager instance. Does not affect restoration. */
    readonly instanceId?: string;
    /**
     * Optional adapter selector (e.g. a BlueZ adapter path like
     * '/org/bluez/hci0'). When omitted, the host picks the first adapter in a
     * deterministic order, so a single-adapter machine needs no configuration and
     * a multi-adapter machine picks the same one every run. Set this only to
     * target a specific controller (e.g. a second USB dongle) - an unusual need.
     */
    readonly adapterId?: string;
    readonly diagnostics?: DiagnosticsOptions;
    /**
     * Entropy source for this manager's ephemeral nonces. Required on hosts
     * without WebCrypto unless the host factory supplies a native CSPRNG.
     */
    readonly randomBytes?: (length: number) => Uint8Array;
    /** One app-facing restoration token; native derives all internal identity values. */
    readonly restoration?: {
        readonly restorationId: string;
        readonly generation?: string;
    };
}
export interface DiagnosticsOptions {
    readonly traceMaximumRecords?: number;
    readonly traceMaximumBytes?: number;
    readonly maximumValueBytes?: number;
}
export declare function normalizeBleManagerCreateOptions(options: BleManagerCreateOptions | undefined): BleManagerCreateOptions;
export declare const __testing: Readonly<{
    RESTORATION_DOMAIN_SEPARATOR: "ubm-restoration-v1";
    normalizeRestorationBootstrapRequest: typeof normalizeRestorationBootstrapRequest;
}>;
//# sourceMappingURL=host-identity.d.ts.map