import { type ReplayWindow } from "./replay.js";
import type { ClientId, EncryptedMessage, SessionKeys } from "./types.js";
/** Crypto state for one direction of communication (traffic key, counters, replay) */
interface ChannelState {
    trafficKey: Uint8Array;
    sendSeq: bigint;
    recvWindow: ReplayWindow;
}
/** Client session (daemon-side state for each connected client) */
export interface ClientSession {
    clientId: ClientId;
    clientToDaemon: ChannelState;
    daemonToClient: ChannelState;
}
/** Daemon session (client-side state for communicating with daemon) */
export interface DaemonSession {
    clientToDaemon: ChannelState;
    daemonToClient: ChannelState;
}
/**
 * Create a client session (daemon side).
 *
 * Used by daemon to manage state for each connected client.
 */
export declare function createClientSession(clientId: ClientId, sessionKeys: SessionKeys): ClientSession;
/**
 * Create a daemon session (client side).
 *
 * Used by client to communicate with daemon.
 */
export declare function createDaemonSession(sessionKeys: SessionKeys): DaemonSession;
/**
 * Encrypt a message from client to daemon.
 */
export declare function encryptClientToDaemon(session: DaemonSession, plaintext: Uint8Array): EncryptedMessage;
/**
 * Encrypt a message from daemon to client.
 */
export declare function encryptDaemonToClient(session: ClientSession, plaintext: Uint8Array): EncryptedMessage;
/**
 * Decrypt a message received by daemon from client.
 *
 * @throws {SbrpError} with code SequenceError if replay detected
 * @throws {SbrpError} with code DecryptFailed if decryption fails
 */
export declare function decryptClientToDaemon(session: ClientSession, message: EncryptedMessage): Uint8Array;
/**
 * Decrypt a message received by client from daemon.
 *
 * @throws {SbrpError} with code SequenceError if replay detected
 * @throws {SbrpError} with code DecryptFailed if decryption fails
 */
export declare function decryptDaemonToClient(session: DaemonSession, message: EncryptedMessage): Uint8Array;
/**
 * Clear all key material from a client session.
 *
 * Best-effort zeroization (JS/GC limitations apply).
 */
export declare function clearClientSession(session: ClientSession): void;
/**
 * Clear all key material from a daemon session.
 *
 * Best-effort zeroization (JS/GC limitations apply).
 */
export declare function clearDaemonSession(session: DaemonSession): void;
export {};
//# sourceMappingURL=session.d.ts.map