/**
 * The device-registration inputs message 1 authenticates.
 *
 * `deviceName` is the one optional field in the contract, and is normalised to
 * `null` when absent so both pairing paths hand `devicesRepo.register` the same
 * shape. The 100-character bound is the legacy path's, kept identical rather
 * than re-chosen: authenticating a value is not a reason to stop bounding it.
 */
export interface E2eePairRegistration {
    version: number;
    deviceName: string | null;
    readOnly: boolean;
}
/**
 * Parse message 1's decrypted payload.
 *
 * Throws rather than defaulting. A client that completed the handshake and then
 * sent an unreadable payload is a protocol violation, not an older client — an
 * older client cannot reach this function at all, because it sends no `e2ee`
 * field and no handshake is performed. Defaulting a missing `readOnly` to
 * `false` would silently grant the wider capability preset off a payload the
 * device never actually stated, which is the exact substitution this contract
 * exists to prevent, arrived at through a parser instead of an intermediary.
 *
 * `v` is checked against the same version and with the same ordering as
 * `parseE2eeRequest`: a version mismatch is not a malformed payload, and saying
 * so is what lets a future client fall back deliberately.
 */
export declare function parseE2eeMsg1Payload(payload: Buffer): E2eePairRegistration;
/**
 * Every pairing result a new client persists or presents as verified.
 *
 * The outer response still carries compatibility copies of `deviceId`,
 * `deviceToken`, `capabilities`, `publicUrl` and `machineName` for released
 * clients that can read nothing else, and a new client ignores all of them —
 * so this shape is the one that has to be complete. A field missing here is a
 * field the new client would have to take from the unauthenticated outer copy,
 * which is the same as not authenticating it at all.
 *
 * `deviceId` and `deviceToken` are non-nullable on purpose: an E2EE pairing
 * that cannot produce them is a failed pairing, not a success carrying nulls.
 */
export interface E2eeMsg2Payload {
    v: number;
    deviceId: string;
    deviceToken: string;
    capabilities: string[];
    publicUrl: string | null;
    machineName: string;
    serverVersion: string;
    /**
     * Always `true`. Completing a handshake is what pins the device, and
     * design.md §6.3 says nothing a client sends ever clears it — so this is a
     * literal here rather than an argument, and there is no call site that can
     * pass `false` by accident.
     */
    e2eeRequired: true;
}
export declare function encodeE2eeMsg2Payload(fields: Omit<E2eeMsg2Payload, "v" | "e2eeRequired">): Buffer;
//# sourceMappingURL=pair-payload.d.ts.map