/**
 * envelope – builds a cryptographic envelope around pipeline result (transversal).
 *
 * @remarks
 * The envelope is a cross-cutting concern: it wraps the result of the pipeline
 * (e.g. ISL result or AAL-cleaned result) with integrity and anti-replay guarantees:
 * - Metadata: timestamp, nonce, protocol version
 * - Signature: HMAC-SHA256 over payload + metadata
 * - Lineage: appends an envelope step to the existing lineage
 *
 * This is not a processing layer; it applies to whatever output the SDK chooses
 * to wrap (after ISL or after AAL). Serialization and verification belong in the SDK.
 *
 * @param islResult - Pipeline result with segments (e.g. ISLResult); must have at least one segment
 * @param secretKey - Secret key for HMAC. Must not be logged, serialized, or exposed. Key rotation
 *   and secure storage are the SDK's responsibility (e.g. key id in metadata, multiple keys in verifier).
 * @returns CPEResult with envelope and optional processingTimeMs
 * @throws {EnvelopeError} If input is invalid or generation fails
 */
import type { ISLResult } from '../../isl/types.js';
import type { CPEResult } from './types.js';
export declare function envelope(islResult: ISLResult, secretKey: string): CPEResult;
//# sourceMappingURL=envelope.d.ts.map