export interface Sealer {
    /** Seals bytes. The result is self-contained — see `format.ts`. */
    encrypt(data: Uint8Array | ArrayBuffer | Blob): Promise<Uint8Array>;
    /** Seals a string to base64url, for the upload label. */
    encryptText(text: string): Promise<string>;
}
/**
 * The uploading side.
 *
 * Takes the recipient's public key, exactly as it arrived in the URL fragment,
 * and needs nothing else — no network, no server, no shared state. That is the
 * property that makes this end-to-end: this half of the exchange never talks to
 * anything.
 *
 * One ephemeral keypair per sealer, reused across the file and the label with
 * a fresh IV each time. Reusing an IV under one key would be catastrophic for
 * AES-GCM, which is why every call draws a new one from `getRandomValues` and
 * there is no way to supply your own.
 */
export declare function createSealer(recipientPublicKey: string): Promise<Sealer>;
/**
 * Reads the recipient's public key out of a URL fragment.
 *
 * The fragment is where it has to be. A browser never sends `#…` to the server,
 * so the key reaches this page in the URL itself and the server that stores the
 * ciphertext never sees it. Put the same value in the query string and the
 * encryption is decorative.
 *
 * Returns null when there is none, which is the unencrypted case.
 */
export declare function keyFromFragment(hash?: string): string | null;
//# sourceMappingURL=seal.d.ts.map