//#region ../encryption/src/envelope.d.ts
/**
 * Envelope version 1 — the only format this package writes.
 *
 * A leading version byte makes the format self-describing: future algorithm
 * changes bump the version (or the suite) and `decrypt` can still recognise,
 * and refuse or handle, every generation of ciphertext it is handed.
 */
declare const ENVELOPE_VERSION_1 = 1;
/**
 * Cipher suite 1 — PBKDF2-HMAC-SHA256 → AES-256-GCM with a 128-bit tag.
 */
declare const SUITE_PBKDF2_SHA256_AES_256_GCM = 1;
/** Random per-message PBKDF2 salt, in bytes. */
declare const SALT_LENGTH = 16;
/** Random per-message GCM nonce, in bytes. 96 bits is the GCM-native size. */
declare const IV_LENGTH = 12;
/** GCM authentication tag, in bytes (128 bits). */
declare const AUTH_TAG_LENGTH = 16;
/** GCM authentication tag, in bits — what WebCrypto's `tagLength` wants. */
declare const AUTH_TAG_LENGTH_BITS: number;
/**
 * version(1) + suite(1) + iterations(4, uint32 BE) + salt(16) + iv(12).
 *
 * The whole header is fed to AES-GCM as additional authenticated data, so the
 * declared iteration count, salt and nonce are covered by the auth tag and
 * cannot be edited without the tag check failing.
 */
declare const HEADER_LENGTH: number;
/** OWASP-aligned default work factor for PBKDF2-HMAC-SHA256. */
declare const DEFAULT_ITERATIONS = 210000;
/** Floor enforced when encrypting. Below this the KDF is not worth its name. */
declare const MIN_ITERATIONS = 100000;
/**
 * Ceiling accepted when decrypting.
 *
 * The iteration count is read out of attacker-reachable ciphertext, so an
 * unbounded value would be a trivial CPU-exhaustion vector: a forged envelope
 * claiming 4 billion iterations would pin a core for minutes before the tag
 * check ever ran. Anything above this is rejected before key derivation.
 */
declare const MAX_ITERATIONS = 5000000;
type EncryptionEnvelope = {
  version: number;
  suite: number;
  iterations: number;
  salt: Uint8Array;
  iv: Uint8Array; /** The raw header bytes, reused verbatim as GCM additional authenticated data. */
  header: Uint8Array; /** Ciphertext with the GCM tag appended, exactly as WebCrypto returns it. */
  payload: Uint8Array;
};
/**
 * Build the 34-byte version-1 header.
 */
declare function buildHeader(iterations: number, salt: Uint8Array, iv: Uint8Array): Uint8Array;
/**
 * Serialise header + payload into the base64 string handed back to callers.
 */
declare function encodeEnvelope(header: Uint8Array, payload: Uint8Array): string;
/**
 * Parse a ciphertext string as a version-1 envelope.
 *
 * Returns `null` when the input is not a version-1 envelope at all (bad
 * base64, or a different leading version byte) — that is the signal to try the
 * legacy path. Throws when the input *claims* to be a version-1 envelope but
 * is truncated, uses an unknown suite, or declares an implausible work factor;
 * those are corrupt/hostile inputs, not old data.
 */
declare function parseEnvelope(cipher: string): EncryptionEnvelope | null;
/**
 * Whether the given string looks like a version-1 AES-GCM envelope.
 *
 * Useful for migration scripts that walk a store and re-encrypt whatever is
 * still in the legacy format.
 */
declare function isEncryptionEnvelope(cipher: string): boolean;
//#endregion
export { AUTH_TAG_LENGTH, AUTH_TAG_LENGTH_BITS, DEFAULT_ITERATIONS, ENVELOPE_VERSION_1, EncryptionEnvelope, HEADER_LENGTH, IV_LENGTH, MAX_ITERATIONS, MIN_ITERATIONS, SALT_LENGTH, SUITE_PBKDF2_SHA256_AES_256_GCM, buildHeader, encodeEnvelope, isEncryptionEnvelope, parseEnvelope };
//# sourceMappingURL=envelope.d.mts.map