/**
 * WinZip AES (AE-2) encryption for ZIP entries — AES-256 by default.
 *
 * Layout of an encrypted entry's payload: `salt || pwdVerify(2) || ciphertext ||
 * authCode(10)`. Keys come from PBKDF2-HMAC-SHA1 (1000 iterations) over the
 * password and salt; the data is AES-CTR encrypted and authenticated with a
 * truncated HMAC-SHA1. PBKDF2/HMAC use WebCrypto (standard, cross-runtime); the
 * CTR keystream uses {@link Aes} because WebCrypto's counter endianness differs
 * from WinZip's. Interoperates with 7-Zip / WinZip AES archives.
 */
/** AES strength codes used in the 0x9901 extra field. */
export type AesStrength = 1 | 2 | 3;
/**
 * Encrypt already-compressed `data` as a WinZip AE-2 payload. Returns the bytes
 * that go where the compressed data would otherwise sit, plus the strength code
 * for the entry's 0x9901 extra field.
 */
export declare function aesEncrypt(data: Uint8Array, password: string, strength?: AesStrength): Promise<{
    payload: Uint8Array;
    strength: AesStrength;
}>;
/**
 * Decrypt a WinZip AE-2 payload back to the compressed bytes. Throws
 * {@link ZipKitError} on a wrong password (verifier mismatch) or a failed
 * authentication check (tampered/corrupt data).
 */
export declare function aesDecrypt(payload: Uint8Array, password: string, strength: AesStrength): Promise<Uint8Array>;
//# sourceMappingURL=winzip.d.ts.map