import { AppSyncClient } from '../appsync/appsync-client';
/**
 * Options for re-keying behavior.
 */
export interface RekeyOptions {
    /**
     * Set of deviceIds that should be force-wrapped (granted) even if
     * they already have an entry in `session.encryptedKeys`. Use this
     * when you know a specific device just re-registered — for example,
     * when handling an `onDeviceKeyRegistered` subscription event — so
     * a rotated public key gets a fresh wrapped entry. The old entry
     * is left intact; the new one is appended via `grantSessionKey`.
     *
     * Default: empty. The bulk diff path (catch-up after disconnect,
     * catch-up at session resume) does not pass this and relies on the
     * standard "deviceId missing from encryptedKeys" comparison.
     */
    forceDeviceIds?: ReadonlySet<string>;
}
/**
 * Compare the current list of registered devices for the authenticated
 * user against the session's encryptedKeys array, and grant the session
 * key to any device that is missing an entry (or that the caller has
 * explicitly marked as needing a fresh wrap via `forceDeviceIds`).
 *
 * Safe to call repeatedly. No-op when every registered device already
 * has an entry and nothing is forced. Does not modify or remove existing
 * entries — only appends new ones via the grantSessionKey mutation.
 *
 * @param sessionId  The session to re-key.
 * @param sessionKey The plaintext session key (base64). The caller must
 *                   already hold this — typically from
 *                   keychainManager.getCachedSessionKey(sessionId).
 * @param appSyncClient Authenticated AppSyncClient.
 * @param options Optional behavior knobs. See RekeyOptions.
 * @returns The number of new grants that succeeded.
 */
export declare function rekeySessionForNewDevices(sessionId: string, sessionKey: string, appSyncClient: AppSyncClient, options?: RekeyOptions): Promise<number>;
