/**
 * @module pairing-manager
 * Security validation for peer-to-peer device pairing via mDNS.
 *
 * Security properties:
 * - 16-byte cryptographically secure nonce (prevents replay attacks)
 * - 60-second timeout (limits attack window)
 * - User confirmation required on BOTH devices
 * - Nonce echo in response (prevents MITM substitution)
 * - Trust registry integration (stores paired DIDs with scopes)
 * - Gold Standard compliant (GS-CONNECT requirement #26, GS-SEC-RNG compliant)
 */
import { Result } from '@private.me/shared';
import type { TrustRegistry } from './trust-registry';
/**
 * Pairing request (Device A → Device B).
 */
export interface PairingRequest {
    /** DID of initiating device (Device A) */
    readonly device_a_did: string;
    /** Cryptographically secure nonce (16 bytes, hex-encoded) */
    readonly nonce: string;
    /** Request timestamp (milliseconds since epoch) */
    readonly timestamp: number;
}
/**
 * Pairing response (Device B → Device A).
 */
export interface PairingResponse {
    /** DID of responding device (Device B) */
    readonly device_b_did: string;
    /** Whether pairing was accepted */
    readonly accepted: boolean;
    /** Echo of nonce from request (prevents MITM) */
    readonly nonce: string;
}
/**
 * Pairing manager for secure peer-to-peer device pairing.
 *
 * Implements challenge-response protocol with user confirmation.
 * Integrates with trust registry for persistent pairing storage.
 */
export declare class PairingManager {
    private readonly pendingNonces;
    private readonly registry;
    private readonly deviceDid;
    /**
     * Create pairing manager.
     *
     * @param deviceDid - DID of this device
     * @param registry - Trust registry instance
     */
    constructor(deviceDid: string, registry: TrustRegistry);
    /**
     * Create pairing request.
     *
     * Generates cryptographically secure nonce and stores it for validation.
     * Device A calls this before sending request to Device B.
     *
     * @returns Pairing request to send to remote device
     *
     * @example
     * ```typescript
     * const manager = new PairingManager('did:key:z6MkA...', registry);
     * const request = manager.createRequest();
     * // Send request to Device B via HTTP POST
     * const response = await fetch(`${deviceB.endpoint}/pair`, {
     *   method: 'POST',
     *   body: JSON.stringify(request),
     * });
     * ```
     */
    createRequest(): PairingRequest;
    /**
     * Validate pairing request.
     *
     * Checks timeout and nonce uniqueness.
     * Device B calls this when receiving request from Device A.
     *
     * @param request - Pairing request from remote device
     * @returns Ok if valid, Err with reason if invalid
     *
     * @example
     * ```typescript
     * // Device B receives request
     * const validation = manager.validateRequest(request);
     * if (!validation.ok) {
     *   return res.status(400).json({ error: validation.error });
     * }
     * ```
     */
    validateRequest(request: PairingRequest): Result<void, string>;
    /**
     * Accept pairing request.
     *
     * Shows UI prompt for user confirmation, then stores in trust registry.
     * Device B calls this after validating request.
     *
     * @param request - Validated pairing request
     * @param promptCallback - Async function to show UI prompt (returns true if accepted)
     * @returns Pairing response to send back to Device A
     *
     * @example
     * ```typescript
     * const response = await manager.acceptPairing(request, async () => {
     *   // Show modal: "Device {name} wants to pair. Accept?"
     *   return await showConfirmationDialog({
     *     title: 'Pair with Device?',
     *     message: `DID: ${request.device_a_did.slice(0, 20)}...`,
     *   });
     * });
     *
     * if (response.ok && response.value.accepted) {
     *   // Send response back to Device A
     * }
     * ```
     */
    acceptPairing(request: PairingRequest, promptCallback: () => Promise<boolean>): Promise<Result<PairingResponse, string>>;
    /**
     * Finalize pairing.
     *
     * Verifies response nonce and stores remote DID in trust registry.
     * Device A calls this after receiving response from Device B.
     *
     * @param response - Pairing response from Device B
     * @param expectedNonce - Nonce from original request (for verification)
     * @returns Ok if successful, Err if nonce mismatch or storage failed
     *
     * @example
     * ```typescript
     * const request = manager.createRequest();
     * const response = await sendPairingRequest(deviceB.endpoint, request);
     *
     * const result = await manager.finalizePairing(response, request.nonce);
     * if (result.ok) {
     *   console.log('Pairing successful!');
     * } else {
     *   console.error('Pairing failed:', result.error);
     * }
     * ```
     */
    finalizePairing(response: PairingResponse, expectedNonce: string): Promise<Result<void, string>>;
    /**
     * Get pending nonce count (for debugging/monitoring).
     */
    getPendingNonceCount(): number;
}
