/**
 * remote/relay-client — the PC ("host") side of the sovereign relay.
 *
 * `connectRelay` registers a session on the relay, returns the pairing
 * payload (the PC shows it as a QR), then in the background:
 *   - waits for the phone ("guest") to join → X25519 ECDH → shared key;
 *   - bridges the local `RemoteControlHub` event stream OUT, end-to-end
 *     encrypted, through the relay;
 *   - decrypts inbound frames → instruction injections + HITL verdicts.
 *
 * The relay never holds the shared key — it forwards ciphertext only.
 * Both PC and phone dial OUT to the relay: no inbound ports, NAT-friendly.
 *
 * @public @since 2.12.0 — preste remote-control T2
 */
import { type PairingPayload } from "./relay-protocol.js";
import type { RemoteControlPort } from "./port.js";
import type { RemoteApprovalChannel } from "./approval.js";
export interface ConnectRelayOptions {
    /** Base URL of the relay, e.g. https://relay.vauban.tech */
    relayUrl: string;
    /** The local hub whose events are bridged out and whose inbox receives injections. */
    hub: RemoteControlPort;
    /** When set, inbound HITL verdicts are applied to it. */
    approvalChannel?: RemoteApprovalChannel;
    /** Called when the phone successfully pairs. */
    onPaired?: () => void;
}
export interface RelayConnection {
    /** The pairing payload — encode to a QR with `encodePairingPayload`. */
    readonly pairing: PairingPayload;
    /** True once the guest has paired and the shared key is established. */
    isPaired(): boolean;
    /** Tear down: abort the relay streams, stop bridging. */
    close(): Promise<void>;
}
/**
 * Register a relayed remote-control session and start bridging.
 * Resolves as soon as the session is registered (so the caller can show the
 * QR immediately); pairing completes asynchronously when the phone joins.
 */
export declare function connectRelay(opts: ConnectRelayOptions): Promise<RelayConnection>;
//# sourceMappingURL=relay-client.d.ts.map