/**
 * Wrap a CEK under a key-encryption key.
 *
 * @param {Buffer} kek  16- or 32-byte key-encryption key.
 * @param {Buffer} cek  The content-encryption key to wrap.
 * @returns {Buffer} The wrapped key (CEK length + 8 bytes).
 */
export function aesKeyWrap(kek: Buffer, cek: Buffer): Buffer;
/**
 * Unwrap a CEK under a key-encryption key. A failed integrity check
 * surfaces as {@link ErrorCode.DECRYPTION_FAILED}.
 *
 * @param {Buffer} kek  16- or 32-byte key-encryption key.
 * @param {Buffer} wrapped  The wrapped key from the JWE Encrypted Key segment.
 * @returns {Buffer} The unwrapped CEK.
 */
export function aesKeyUnwrap(kek: Buffer, wrapped: Buffer): Buffer;