/**
 * The wrap output: the CEK plus the Encrypted Key segment and any
 * header parameters the key-management step contributes (e.g. `epk`).
 *
 * @typedef {Object} WrapResult
 * @property {Buffer} cek
 * @property {Buffer} encryptedKey
 * @property {Record<string, unknown>} header
 */
/**
 * Derive the CEK and Encrypted Key for one recipient.
 *
 * @param {AlgDescriptor} alg
 * @param {EncDescriptor} enc
 * @param {KeyInput} key
 * @param {{ apu?: unknown, apv?: unknown }} [options]
 * @param {Buffer} [sharedCek]  A CEK fixed by the caller (JSON multi-recipient).
 *   Not permitted for `dir` / bare `ECDH-ES`, which determine the CEK themselves.
 * @returns {WrapResult}
 */
export function wrapCek(alg: AlgDescriptor, enc: EncDescriptor, key: KeyInput, options?: {
    apu?: unknown;
    apv?: unknown;
}, sharedCek?: Buffer): WrapResult;
/**
 * Recover the CEK for one recipient.
 *
 * @param {AlgDescriptor} alg
 * @param {EncDescriptor} enc
 * @param {KeyInput} key
 * @param {Record<string, unknown>} header  The merged (protected + per-recipient) header.
 * @param {Buffer} encryptedKey
 * @returns {Buffer}
 */
export function unwrapCek(alg: AlgDescriptor, enc: EncDescriptor, key: KeyInput, header: Record<string, unknown>, encryptedKey: Buffer): Buffer;
/**
 * The wrap output: the CEK plus the Encrypted Key segment and any
 * header parameters the key-management step contributes (e.g. `epk`).
 */
export type WrapResult = {
    cek: Buffer;
    encryptedKey: Buffer;
    header: Record<string, unknown>;
};
export type AlgDescriptor = import("./algorithms.js").KeyManagementDescriptor;
export type EncDescriptor = import("./encryptions.js").ContentEncryptionDescriptor;
export type KeyInput = import("./keys.js").KeyInput;