type RemoteAccessRole = "requester" | "source";
type RemoteAccessDirection = "request" | "result";
interface RemoteAccessCryptoIdentity {
    ownerId: string;
    contextType?: "personal" | "team";
    contextId?: string;
    projectId: string;
    sourceId: string;
    sourceSessionId: string;
    requestingClientId: string;
    hostMemberId?: string;
    hostDeviceId?: string;
    requesterMemberId?: string;
    requesterDeviceId?: string;
    keyEpoch: number;
}
interface RemoteAccessHandshake {
    version: 1 | 2;
    role: RemoteAccessRole;
    publicKey: string;
    authenticationTag: string;
}
interface RemoteAccessEnvelope {
    version: 1 | 2;
    nonce: string;
    ciphertext: string;
}
declare class RemoteAccessReplayGuard {
    private readonly seen;
    assertUnused(nonce: string): void;
    markUsed(nonce: string): void;
}
declare function createRemoteAccessHandshake(projectKey: Uint8Array, identity: RemoteAccessCryptoIdentity, role: RemoteAccessRole): Promise<{
    privateKey: string;
    handshake: RemoteAccessHandshake;
}>;
declare function deriveRemoteAccessSessionKey(projectKey: Uint8Array, identity: RemoteAccessCryptoIdentity, localRole: RemoteAccessRole, localPrivateKey: string, localHandshake: RemoteAccessHandshake, remoteHandshake: RemoteAccessHandshake): Promise<Uint8Array>;
declare function sealRemoteAccessEnvelope(sessionKey: Uint8Array, identity: RemoteAccessCryptoIdentity, requestId: string, direction: RemoteAccessDirection, plaintext: Uint8Array): Promise<RemoteAccessEnvelope>;
declare function openRemoteAccessEnvelope(sessionKey: Uint8Array, identity: RemoteAccessCryptoIdentity, requestId: string, direction: RemoteAccessDirection, envelope: RemoteAccessEnvelope, replayGuard: RemoteAccessReplayGuard): Promise<Uint8Array>;

export { type RemoteAccessCryptoIdentity, type RemoteAccessDirection, type RemoteAccessEnvelope, type RemoteAccessHandshake, RemoteAccessReplayGuard, type RemoteAccessRole, createRemoteAccessHandshake, deriveRemoteAccessSessionKey, openRemoteAccessEnvelope, sealRemoteAccessEnvelope };