/**
 * @typedef {import('node:crypto').KeyObject | Buffer | Uint8Array | string | Record<string, unknown>} KeyInput
 */
/**
 * Normalise caller-supplied symmetric key material to a `Buffer` of the
 * exact expected length.
 *
 * @param {KeyInput} key
 * @param {number} expectedBytes
 * @param {string} label  Human context for the error message (`alg`).
 * @returns {Buffer}
 */
export function normalizeSymmetric(key: KeyInput, expectedBytes: number, label: string): Buffer;
/**
 * Normalise caller-supplied key material to a public `KeyObject` (used
 * when encrypting). A private key / JWK is accepted and reduced to its
 * public half.
 *
 * @param {KeyInput} key
 * @returns {KeyObject}
 */
export function normalizePublicKey(key: KeyInput): KeyObject;
/**
 * Normalise caller-supplied key material to a private `KeyObject` (used
 * when decrypting).
 *
 * @param {KeyInput} key
 * @returns {KeyObject}
 */
export function normalizePrivateKey(key: KeyInput): KeyObject;
/**
 * Assert a public key is RSA and (best-effort) at least 2048-bit, per
 * RFC 7518 §4.3 guidance.
 *
 * @param {KeyObject} key
 */
export function assertRsaPublicKey(key: KeyObject): void;
export type KeyInput = any | Buffer | Uint8Array | string | Record<string, unknown>;