import { type ReceizMcpRuntime } from "./index.js";
/** Carry the relay's own attempt locator with an app-only proof chunk. The
 * locator lets the first-party Receiz route re-read the held exact bytes; it
 * never authorizes sealing, verification, or proof admission. */
export declare function attachReceizChunkAttempt(request: Record<string, unknown>, response: Record<string, unknown>, attemptId: string): Record<string, unknown>;
/** Device-side transport. The owner is read from a genuine SDK admission, never
 * from a tool argument or OAuth claim. Completed replies retry; execution does not. */
export declare function runReceizMcpDeviceRelay(options: Readonly<{
    runtime: ReceizMcpRuntime;
    endpoint: string;
    accessToken: string;
    /** Explicit OAuth account target; never changes the admitted artifact owner. */
    transportOwnerId?: string;
    directory: string;
    signal: AbortSignal;
    fetch?: typeof globalThis.fetch;
    onError?: (code: string) => void;
    /** Host configuration only. OAuth transport never establishes Receiz identity. */
    refresh?: Readonly<{
        refreshToken: string;
        clientId: string;
        clientSecret?: string;
    }>;
}>): Promise<void>;
//# sourceMappingURL=deviceRelay.d.ts.map