export type BrowserStateOperationScope = {
    accountId: string;
    workspaceId: string;
    browserSessionId: string;
    operationId: string;
    objectKey: string;
};
export type BrowserStateArtifactScope = {
    accountId: string;
    workspaceId: string;
    objectKey: string;
    artifactDigest: string;
    contentDigest: string;
};
/** Deterministic only within one idempotent publication operation. This lets a
 * control-plane retry present browserd with exactly the same secret authority
 * without storing a plaintext key or placing it in an operation row. */
export declare function deriveBrowserStateDataKey(rootKey: Uint8Array, scopeInput: BrowserStateOperationScope): Buffer;
/** Associated data for the encrypted profile object. It is reproducible from
 * durable non-secret artifact authority during restore. */
export declare function browserStateArtifactAad(scopeInput: Pick<BrowserStateArtifactScope, "accountId" | "workspaceId" | "objectKey">): Buffer;
/** Wrap a 32-byte artifact data key under the operator-held root key. The
 * ciphertext is bound to workspace, object, and both integrity digests. */
export declare function wrapBrowserStateDataKey(rootKey: Uint8Array, dataKeyInput: Uint8Array, scopeInput: BrowserStateArtifactScope): string;
export declare function unwrapBrowserStateDataKey(rootKey: Uint8Array, wrapped: string, scopeInput: BrowserStateArtifactScope): Buffer;
export declare function browserStateObjectKey(workspaceIdInput: string, operationIdInput: string): string;
export declare function browserStateManifestDigest(manifest: unknown): string;