/** The pre-flip application type of an encrypted column (SPEC.md §5.11). */
export type DeclaredType = 'string' | 'integer' | 'float' | 'boolean' | 'json' | 'blob_ref' | 'bytes';
/** A non-null row value, per the declared type. `crdt` is never encrypted. */
export type PlainValue = string | number | boolean | Uint8Array;
/** Envelope version byte (SPEC.md §5.11). */
export declare const ENVELOPE_VERSION = 1;
/** AES-GCM nonce length (96-bit, the GCM standard). */
export declare const NONCE_LENGTH = 12;
/** Symmetric key length: AES-256. */
export declare const KEY_LENGTH = 32;
/**
 * Client-local decrypt failure (SPEC.md §5.11, §10.3). Never on the wire —
 * the `client.` family is client-only. Raised at the apply seam for an
 * unknown envelope version, unknown `keyId`, GCM auth failure (wrong key), a
 * malformed envelope, or a post-decrypt value-parse failure. Not retryable.
 */
export declare class DecryptError extends Error {
    readonly name = "DecryptError";
    readonly code = "client.decrypt_failed";
    readonly retryable = false;
}
/**
 * Client-local encrypt failure (SPEC.md §5.11, §10.3). Never on the wire.
 * Raised at the encode-at-send seam when the key id cannot be resolved
 * from the present columns or the stored local row, or the selected key
 * is unknown. Not retryable unmodified. Distinct from {@link DecryptError},
 * which is apply-seam only.
 */
export declare class EncryptError extends Error {
    readonly name = "EncryptError";
    readonly code = "client.encrypt_failed";
    readonly retryable = false;
}
/**
 * Injectable nonce source (SPEC.md §5.11 nonce discipline). Production uses
 * {@link secureRandomNonce}; crypto golden vectors inject a fixed nonce. A
 * fixed nonce MUST NOT be reachable from a production encode path.
 */
export type NonceSource = () => Uint8Array;
export declare function secureRandomNonce(): Uint8Array;
/**
 * Serialize a declared-type value to the canonical plaintext bytes fed to
 * GCM (SPEC.md §5.11 value serializer). Not a re-run of the row codec — this
 * is the self-describing per-`declaredType` encoding both cores agree on.
 */
export declare function serializePlain(declaredType: DeclaredType, value: PlainValue): Uint8Array;
/**
 * Parse the decrypted plaintext bytes back to a declared-type value (SPEC.md
 * §5.11). A `json`/`blob_ref` value is re-validated as the row codec would
 * (§2.4); any parse failure is a decrypt failure.
 */
export declare function deserializePlain(declaredType: DeclaredType, bytes: Uint8Array): PlainValue;
export interface Envelope {
    readonly keyId: string;
    readonly nonce: Uint8Array;
    /** AES-256-GCM ciphertext with the 16-byte tag appended. */
    readonly ciphertext: Uint8Array;
}
export declare function encodeEnvelope(envelope: Envelope): Uint8Array;
export declare function decodeEnvelope(bytes: Uint8Array): Envelope;
/**
 * Encrypt one declared-type value into a §5.11 envelope. `nonceSource`
 * defaults to a secure RNG; vectors inject a fixed nonce.
 */
export declare function encryptValue(declaredType: DeclaredType, value: PlainValue, keyId: string, key: Uint8Array, nonceSource?: NonceSource): Promise<Uint8Array>;
/**
 * Decrypt a §5.11 envelope back to a declared-type value. `keyProvider`
 * resolves the envelope's `keyId` to key bytes; a missing key or GCM tag
 * mismatch is {@link DecryptError} (`client.decrypt_failed`).
 */
export declare function decryptValue(declaredType: DeclaredType, envelopeBytes: Uint8Array, keyProvider: (keyId: string) => Uint8Array | undefined): Promise<PlainValue>;