import { createPrivateKey } from "node:crypto";
import { ReplayWindow } from "@openmono/protocol";
export { ReplayWindow };
export interface Ed25519KeyPair {
    publicKey: Buffer;
    privateKey: Buffer;
}
export declare function generateEd25519KeyPair(): Ed25519KeyPair;
export declare function ed25519Sign(privateKeyDer: Buffer, message: Buffer): Buffer;
export declare function ed25519Verify(publicKeyRaw: Buffer, message: Buffer, signature: Buffer): boolean;
/** Derive a 16-char nodeId from an Ed25519 public key: base64url(SHA256(pubkey))[:16] */
export declare function deriveNodeId(ed25519PublicKey: Buffer): string;
export interface X25519KeyPair {
    publicKey: Buffer;
    privateKey: Buffer;
    _privateKeyObject: ReturnType<typeof createPrivateKey>;
}
export declare function generateX25519KeyPair(): X25519KeyPair;
export declare function x25519SharedSecret(localKeyPair: X25519KeyPair, remotePublicKeyRaw: Buffer): Buffer;
/**
 * Derive directional session keys from ECDH shared secret + transcript hash.
 *
 * Returns [sendKey, recvKey] — caller with lexicographically smaller pubkey
 * gets send=HKDF(..."feno-send-v1"), recv=HKDF(..."feno-recv-v1").
 */
export declare function deriveDirectionalKeys(sharedSecret: Buffer, transcriptHash: Buffer, localIdentityPubkey: Buffer, remoteIdentityPubkey: Buffer): {
    sendKey: Buffer;
    recvKey: Buffer;
};
/** Legacy: single session key derivation (for backward compat during migration). */
export declare function deriveSessionKey(localKeyPair: X25519KeyPair, remotePublicKeyRaw: Buffer, salt?: Buffer): Buffer;
export declare function derivePerPeerSecret(masterSecret: string, nodeIdA: string, nodeIdB: string): string;
/** Build a handshake transcript by length-prefixed concatenation, then SHA256. */
export declare function buildTranscriptHash(parts: (string | Buffer)[]): Buffer;
/** Build a counter-based nonce: [direction:1][counter:11 big-endian]. */
export declare function buildCounterNonce(direction: 0x01 | 0x02, counter: bigint): Buffer;
export declare function encryptBinary(sessionKey: Buffer, plaintext: string, compress?: boolean): string;
export declare function decryptBinary(sessionKey: Buffer, b64: string): string;
export declare function encryptBinaryRaw(sessionKey: Buffer, plaintext: string, compress?: boolean, nonce?: Buffer): Buffer;
export declare function decryptBinaryRaw(sessionKey: Buffer, buf: Buffer): string;
export declare function isBinaryEncrypted(s: string): boolean;
export declare function publicKeyToBase64(key: Buffer): string;
export declare function publicKeyToBase64url(key: Buffer): string;
export declare function base64ToPublicKey(b64: string): Buffer;
export declare function base64urlToPublicKey(b64url: string): Buffer;