import { type WebCryptoKey } from './webcrypto';
/** Encoded P-256 public key and encapsulation length (uncompressed SEC1). */
export declare const HPKE_P256_PUBLIC_KEY_BYTES = 65;
/** AES-GCM authentication tag length. */
export declare const HPKE_AEAD_TAG_BYTES = 16;
type Bytes = Uint8Array<ArrayBuffer>;
/**
 * Import an uncompressed SEC1 P-256 public key for ECDH.
 *
 * The length and `0x04` prefix are checked here; the on-curve check is the
 * WebCrypto import itself, which rejects a point that is not on P-256.
 */
export declare function importP256PublicKey(raw: Uint8Array): Promise<WebCryptoKey>;
/** Key schedule output for base mode. Exported for the RFC 9180 conformance tests only. */
export interface HpkeBaseKeySchedule {
    readonly sharedSecret: Uint8Array;
    readonly key: Uint8Array;
    readonly baseNonce: Uint8Array;
    readonly exporterSecret: Uint8Array;
}
/** A caller-fixed ephemeral key pair. Conformance tests only; production always generates one. */
export interface HpkeEphemeralKeyPair {
    readonly privateKey: WebCryptoKey;
    readonly publicKey: Uint8Array;
}
/** `SetupBaseS`. Exported for the RFC 9180 conformance tests only. */
export declare function setupBaseSender(recipientPublicKey: Uint8Array, info: Uint8Array, ephemeral?: HpkeEphemeralKeyPair): Promise<{
    enc: Uint8Array;
    schedule: HpkeBaseKeySchedule;
}>;
/** `SetupBaseR`. Exported for the RFC 9180 conformance tests only. */
export declare function setupBaseRecipient(enc: Uint8Array, recipientPrivateKey: WebCryptoKey, recipientPublicKey: Uint8Array, info: Uint8Array): Promise<HpkeBaseKeySchedule>;
/** `ComputeNonce(seq)`. Exported for the RFC 9180 conformance tests only. */
export declare function hpkeNonce(baseNonce: Uint8Array, sequence: number): Bytes;
/** AEAD seal at an explicit sequence number. Exported for the RFC 9180 conformance tests only. */
export declare function hpkeAeadSeal(schedule: HpkeBaseKeySchedule, sequence: number, aad: Uint8Array, plaintext: Uint8Array): Promise<Bytes>;
/** AEAD open at an explicit sequence number. Exported for the RFC 9180 conformance tests only. */
export declare function hpkeAeadOpen(schedule: HpkeBaseKeySchedule, sequence: number, aad: Uint8Array, ciphertext: Uint8Array): Promise<Bytes>;
/** One-shot `SealBase`: a fresh ephemeral key, sequence 0, never reused. */
export declare function hpkeSealBase(input: {
    readonly recipientPublicKey: Uint8Array;
    readonly info: Uint8Array;
    readonly aad: Uint8Array;
    readonly plaintext: Uint8Array;
}): Promise<{
    enc: Uint8Array;
    ciphertext: Uint8Array;
}>;
/** One-shot `OpenBase`, sequence 0. */
export declare function hpkeOpenBase(input: {
    readonly recipientPrivateKey: WebCryptoKey;
    readonly recipientPublicKey: Uint8Array;
    readonly enc: Uint8Array;
    readonly info: Uint8Array;
    readonly aad: Uint8Array;
    readonly ciphertext: Uint8Array;
}): Promise<Uint8Array>;
export {};