import { KdfParams } from './models/secure-forms.models';
/**
 * SecureFormCryptoService
 *
 * Owns ALL Web Crypto API calls for secure-form encryption.
 * No HTTP calls. No business logic. CryptoKey objects never leave this service as raw bytes.
 */
export declare class SecureFormCryptoService {
    generateCEK(): Promise<CryptoKey>;
    /**
     * Encrypt arbitrary data with the CEK.
     * Output format: 12-byte IV || ciphertext
     */
    encryptWithCEK(cek: CryptoKey, data: ArrayBuffer): Promise<Uint8Array<ArrayBuffer>>;
    /**
     * Decrypt data previously encrypted by encryptWithCEK.
     * Expects input format: 12-byte IV || ciphertext
     */
    decryptWithCEK(cek: CryptoKey, blob: Uint8Array): Promise<ArrayBuffer>;
    /**
     * Wrap the CEK with an RSA-OAEP public key (PEM).
     * Returns base64 string.
     */
    wrapCEK(cek: CryptoKey, publicKeyPem: string): Promise<string>;
    /**
     * Unwrap a base64-encoded wrapped CEK using an RSA-OAEP private key.
     */
    unwrapCEK(wrappedB64: string, privateKey: CryptoKey): Promise<CryptoKey>;
    /**
     * Generate an RSA-4096 keypair for ZK mode.
     * Returns public key as PEM and the private CryptoKey (in-memory only).
     */
    generateKeyPair(): Promise<{
        publicKeyPem: string;
        privateKey: CryptoKey;
    }>;
    /**
     * Encrypt the private key with a user password using PBKDF2 → AES-GCM.
     * Returns the encrypted blob (base64) and the KDF params needed for later decryption.
     * The password is used once and discarded — never stored.
     */
    encryptPrivateKey(privateKey: CryptoKey, password: string): Promise<{
        blob: string;
        kdfParams: KdfParams;
    }>;
    /**
     * Decrypt the private key blob with the user's password and KDF params.
     * Returns an in-memory CryptoKey. Password is used once and discarded.
     */
    decryptPrivateKey(blob: string, password: string, kdfParams: KdfParams): Promise<CryptoKey>;
    /**
     * Import a PEM-encoded RSA private key (SM mode — fetched from server, never cached).
     * Imported with both 'decrypt' (for .enc files) and 'unwrapKey' (for CEK unwrapping).
     */
    importPrivateKeyPem(pem: string): Promise<CryptoKey>;
    /**
     * Decrypt a backend-produced .enc file.
     *
     * .enc files are JSON blobs with the shape:
     *   { version, encrypted, cek_encrypted_b64, iv_b64, ciphertext_b64, tag_b64 }
     *
     * Algorithm:
     *   1. RSA-OAEP decrypt cek_encrypted_b64 → raw AES-256 CEK bytes
     *   2. Import raw bytes as AES-GCM key
     *   3. Concatenate ciphertext_b64 + tag_b64
     *   4. AES-GCM decrypt with iv_b64 → plaintext
     *
     * @param encBytes  Raw bytes of the .enc file (UTF-8 JSON)
     * @param privateKey  RSA-OAEP private key imported with the 'decrypt' usage
     */
    decryptEncFile(encBytes: Uint8Array, privateKey: CryptoKey): Promise<ArrayBuffer>;
    private _importPublicKeyPem;
    private _exportPublicKeyPem;
    private _deriveAesKey;
    /** Create a new ArrayBuffer-backed Uint8Array with random bytes. */
    private _randomBytes;
    /** Slice a view out of a known-ArrayBuffer buffer. */
    private _fromBuffer;
    private _pemToDer;
    private _wrapPkcs1ToPkcs8;
    private _asn1Sequence;
    private _asn1Integer;
    private _asn1Oid;
    private _asn1Null;
    private _asn1OctetString;
    private _asn1Tag;
    private _asn1Length;
    private _concatBytes;
    private _toArrayBuffer;
    private _toBase64;
    private _fromBase64;
}
//# sourceMappingURL=secure-form-crypto.service.d.ts.map