import type { DaemonId, EphemeralKeyPair, HandshakeAccept, HandshakeInit, IdentityKeyPair, SessionKeys } from "./types.js";
/**
 * Create a handshake init message (client side).
 *
 * Generates an ephemeral X25519 keypair for this session.
 */
export declare function createHandshakeInit(): {
    message: HandshakeInit;
    ephemeralKeyPair: EphemeralKeyPair;
};
/**
 * Process handshake init and create accept message (daemon side).
 *
 * 1. Generate ephemeral X25519 keypair
 * 2. Sign ephemeral public key with identity key (context-bound)
 * 3. Derive session keys
 *
 * NOTE: Callers MUST enforce a 30-second handshake timeout per SBRP §1.4.
 * This function does not track time; timeout enforcement is a transport concern.
 */
export declare function processHandshakeInit(init: HandshakeInit, daemonId: DaemonId, identityKeyPair: IdentityKeyPair): {
    message: HandshakeAccept;
    sessionKeys: SessionKeys;
};
/**
 * Process handshake accept message (client side).
 *
 * 1. Verify signature using PINNED identity key (TOFU)
 * 2. Derive session keys using same transcript hash as daemon
 *
 * NOTE: Callers MUST enforce a 30-second handshake timeout per SBRP §1.4.
 * This function does not track time; timeout enforcement is a transport concern.
 *
 * @param ephemeralKeyPair The privateKey is zeroized in-place after key derivation.
 * @throws {SbrpError} IdentityKeyChanged if advertised key doesn't match pinned key
 * @throws {SbrpError} HandshakeFailed if signature verification fails
 */
export declare function processHandshakeAccept(accept: HandshakeAccept, daemonId: DaemonId, pinnedIdentityPublicKey: Uint8Array, ephemeralKeyPair: EphemeralKeyPair): SessionKeys;
//# sourceMappingURL=handshake.d.ts.map