/**
 * remote/relay-protocol — the wire contract for the sovereign relay.
 *
 * The relay is a zero-knowledge rendezvous: the PC ("host") and the phone
 * ("guest") both dial OUT to it (no inbound ports, NAT-friendly); the relay
 * forwards opaque ciphertext frames host↔guest and never decrypts them.
 *
 * Two layers:
 *   - the RELAY layer (this file's HTTP paths + `RelayFrame`) — what the relay
 *     sees: routing + ciphertext blobs + the public keys exchanged at pairing
 *     (public keys are safe in clear);
 *   - the SESSION layer (`RelayMessage`) — the plaintext INSIDE the E2E
 *     envelope, which only the two endpoints can read.
 *
 * @public @since 2.12.0 — preste remote-control T2
 */
import type { SessionEvent } from "./events.js";
export declare const RELAY_PROTOCOL_VERSION = 1;
/**
 * Everything the phone needs to join a session. Encoded into the QR the PC
 * shows. Contains the host's X25519 public key — public, safe to display.
 * The `pairingToken` is a one-time secret: whoever joins with it becomes the
 * guest, so the QR must be shown only to the intended phone.
 */
export interface PairingPayload {
    v: number;
    relayUrl: string;
    sessionId: string;
    pairingToken: string;
    /** Host's ephemeral X25519 public key, base64 DER (SPKI). */
    hostPubKey: string;
}
/** Encode a pairing payload as a compact `preste-pair://` URL. */
export declare function encodePairingPayload(p: PairingPayload): string;
/** Decode a `preste-pair://` URL back to a pairing payload. Throws on garbage. */
export declare function decodePairingPayload(uri: string): PairingPayload;
/** One opaque ciphertext frame forwarded host↔guest. */
export interface RelayFrame {
    /** Base64 AES-256-GCM ciphertext — see `crypto.seal`. The relay cannot read it. */
    frame: string;
}
/** A message exchanged between the two endpoints, encrypted end-to-end. */
export type RelayMessage = 
/** host → guest: a live session event. */
{
    kind: "event";
    event: SessionEvent;
}
/** guest → host: inject a steering instruction. */
 | {
    kind: "inject";
    text: string;
    whisper: boolean;
}
/** guest → host: a HITL verdict. */
 | {
    kind: "hitl";
    requestId: string;
    approved: boolean;
}
/** either direction: a liveness ping. */
 | {
    kind: "ping";
};
export declare const relayPaths: {
    /** POST — host registers a session. */
    readonly session: "/relay/session";
    /** POST — guest joins with the pairing token. */
    readonly join: (id: string) => string;
    /** GET (SSE) — host receives frames from the guest. */
    readonly hostStream: (id: string) => string;
    /** POST — host sends a frame to the guest. */
    readonly hostSend: (id: string) => string;
    /** GET (SSE) — guest receives frames from the host. */
    readonly guestStream: (id: string) => string;
    /** POST — guest sends a frame to the host. */
    readonly guestSend: (id: string) => string;
};
//# sourceMappingURL=relay-protocol.d.ts.map