import type { MiddlewareHandler } from "hono";
import { type E2eeContextRegistry } from "../../e2ee/context";
import type { AppEnv } from "../app";
import type { ApiDeps } from "../types/api-deps";
/** Pure marker: its presence says "this request is sealed", nothing more. */
export declare const HEADER_MARKER = "x-tb-e2ee";
/** The `ctxId`, base64url unpadded — 16 bytes is exactly 22 characters. */
export declare const HEADER_CTX = "x-tb-ctx";
/** The request counter, decimal. Read early (§9 needs it), acted on late (§5). */
export declare const HEADER_SEQ = "x-tb-seq";
/**
 * A sealed record whose HTTP framing cannot carry a body, base64url.
 *
 * The rule is one rule in both directions: bodiless requests (React Native
 * drops a `GET` body) and the one bodiless response (`304`) put the record
 * here; everything whose framing allows a body puts it in the body.
 */
export declare const HEADER_ENVELOPE = "x-tb-env";
/**
 * Ceiling on the header-carried envelope, in ENCODED characters.
 *
 * A header-carried record answers a bodiless request, whose plaintext is empty
 * or near it: header(30) + tag(16) is 46 bytes, 62 base64url characters. 1024
 * is generous slack and still an order of magnitude under Node's 16 KiB header
 * limit, so this bound is the one that fires rather than a 431 from the parser
 * — which is what makes it testable, and testable is the only way it stays
 * true.
 *
 * **Bounded on the encoded length, not the decoded one**, exactly as
 * `pair-request.ts` argues: `Buffer.from(s, "base64url")` allocates in
 * proportion to `s`, so measuring the result performs the allocation the bound
 * exists to prevent.
 */
export declare const MAX_ENVELOPE_HEADER_CHARS = 1024;
/**
 * Ceiling on the body-carried envelope, taken from the record layer rather than
 * repeated: a frame over `MAX_RECORD_BYTES` is refused by `openFrame` anyway,
 * and a second literal is how the two drift into disagreement.
 */
export declare const MAX_ENVELOPE_BODY_BYTES: number;
export declare const e2eeEnvelopeMiddleware: (
/**
 * The device registry, for §13(b)'s per-request `revoked_at` re-check.
 *
 * Read through `deps.devicesRepo()` on every request rather than captured
 * once: the repository is rebuilt when the database is reopened, and a
 * captured handle would keep re-checking revocation against a store that is
 * no longer the live one — which fails OPEN, since a revoked device would
 * still read as live in the stale copy.
 */
deps: Pick<ApiDeps, "devicesRepo">, 
/** Overridden by tests so a suite gets its own registry rather than the process one. */
registry?: E2eeContextRegistry) => MiddlewareHandler<AppEnv>;
//# sourceMappingURL=e2ee-envelope.middleware.d.ts.map