/**
 * Client-side CMEK (Customer-Managed Encryption Key) utilities.
 *
 * Wire format:
 *   [1 byte version = 0x01][12 bytes IV][N bytes ciphertext + 16 bytes GCM tag]
 *
 * The key never leaves the client. Only its SHA-256 fingerprint is sent to the
 * server so the vault can track which key was used without knowing the key.
 *
 * Works in browsers (WebCrypto) and Node.js 18+ (globalThis.crypto).
 */
/**
 * Generate a random 256-bit AES-GCM key.
 * Returns the raw key bytes as a Uint8Array (32 bytes).
 */
export declare function generateCmekKey(): Promise<Uint8Array>;
/**
 * Compute the SHA-256 fingerprint of a CMEK key.
 * Returns a 64-character lowercase hex string.
 */
export declare function cmekFingerprint(key: Uint8Array): Promise<string>;
/**
 * Encrypt plaintext with a CMEK key using AES-256-GCM.
 * Returns the versioned wire-format blob as a Uint8Array.
 */
export declare function cmekEncrypt(plaintext: Uint8Array, keyBytes: Uint8Array): Promise<Uint8Array>;
/**
 * Decrypt a CMEK wire-format blob with the key.
 * Returns the original plaintext as a Uint8Array.
 */
export declare function cmekDecrypt(blob: Uint8Array, keyBytes: Uint8Array): Promise<Uint8Array>;
/**
 * Encode a Uint8Array to a base64 string.
 * Works in browsers and Node.js 18+.
 */
export declare function toBase64(data: Uint8Array): string;
/**
 * Decode a base64 string to a Uint8Array.
 * Works in browsers and Node.js 18+.
 */
export declare function fromBase64(b64: string): Uint8Array;
//# sourceMappingURL=cmek.d.ts.map