/**
 * Byte helpers shared by the sealed-payload modules (#654 E1a).
 *
 * Every function is WebCrypto-only and `node:`-free, so a browser, Workers,
 * Node and Bun run the same code. The subpath `@byok-sdk/core/sealed-payload`
 * exports the sealed-payload interface, but not these helpers. The package
 * root exports none of the sealed-payload modules.
 *
 * Caller input errors throw `sealed_secret_invalid`, the code `hpke.ts`
 * already raises for bad HPKE input. Receiver checks never throw for hostile
 * bytes; they return a typed failure.
 */
import { z } from 'zod';
import { ByokCoreError } from '../errors';
import { decodeBase64Url, encodeBase64Url, type SealingPublicJwk } from '../sealed-provider-secret';
import { type WebCryptoKey } from '../webcrypto';
export type Bytes = Uint8Array<ArrayBuffer>;
/**
 * The strict EC P-256 public JWK core already uses for sealing keys. Member
 * signing keys and member KEM keys use the same shape.
 */
export type P256PublicJwk = SealingPublicJwk;
export declare const P256PublicJwkSchema: z.ZodObject<{
    kty: z.ZodLiteral<"EC">;
    crv: z.ZodLiteral<"P-256">;
    x: z.ZodString;
    y: z.ZodString;
}, z.core.$strict>;
export declare function invalidInput(message: string): ByokCoreError;
export declare function utf8(value: string): Bytes;
export declare function copy(bytes: Uint8Array): Bytes;
export declare function concat(...parts: readonly Uint8Array[]): Bytes;
export declare function hex(bytes: Uint8Array): string;
export { decodeBase64Url, encodeBase64Url };
/** Fresh CSPRNG bytes from `globalThis.crypto`, the same source WebCrypto keys come from. */
export declare function randomBytes(length: number): Bytes;
export declare function sha256(bytes: Uint8Array): Promise<Bytes>;
export declare function hmacSha256(key: Uint8Array, data: Uint8Array): Promise<Bytes>;
/** RFC 5869 HKDF-SHA-256 through WebCrypto's own HKDF. */
export declare function hkdfSha256(ikm: Uint8Array, salt: Uint8Array, info: string, length: number): Promise<Bytes>;
/** A zod string that must be canonical unpadded base64url of exactly `bytes` bytes. */
export declare function base64UrlBytes(bytes: number): z.ZodString;
/** Uncompressed SEC1 bytes of a strict P-256 public JWK, checked to be a point on the curve. */
export declare function p256PublicKeyBytes(publicJwk: P256PublicJwk): Promise<Bytes>;
/**
 * ECDSA P-256 / SHA-256 signature over `data`, as base64url of the 64-byte
 * P1363 form. The signature must verify under `publicJwk`, so a private key
 * that does not pair with the caller's public key throws
 * `sealed_secret_invalid` and signs nothing under another key's id.
 */
export declare function ecdsaSign(publicJwk: P256PublicJwk, privateKey: WebCryptoKey, data: Uint8Array): Promise<string>;
/** True only for a canonical 64-byte P1363 signature that verifies under `publicJwk`. */
export declare function ecdsaVerify(publicJwk: P256PublicJwk, signature: string, data: Uint8Array): Promise<boolean>;