export interface CursorPayload {
    after: string;
}
export type CursorMode = 'signed' | 'encrypted';
export interface CursorCodecOptions {
    /**
     * 'signed' (default): HMAC signature appended to base64 payload. Payload is visible but tamper-proof.
     * 'encrypted': AES-GCM encryption. Payload is completely hidden and tamper-proof.
     */
    mode?: CursorMode;
    /**
     * Optional 32-byte secret key.
     * If not provided, a random ephemeral key is generated per process.
     */
    secret?: string;
}
/**
 * Stateless Cryptographic Cursor for pagination using Web Crypto API.
 *
 * Works in Node >= 16, Deno, Bun, and Cloudflare Workers.
 */
export declare class CursorCodec {
    private readonly _mode;
    private _secretBytes;
    private _secretPromise;
    private readonly _providedSecret;
    private _hmacKey?;
    private _aesKey?;
    constructor(options?: CursorCodecOptions);
    private ensureSecret;
    private getHmacKey;
    private getAesKey;
    /**
     * Asynchronously encodes a payload into a URL-safe cursor string.
     */
    encode(payload: CursorPayload): Promise<string>;
    /**
     * Asynchronously decodes and verifies a cursor string back into its payload.
     * Returns undefined if the cursor is invalid, tampered with, or from a different process/key.
     */
    decode(cursor: string): Promise<CursorPayload | undefined>;
}
//# sourceMappingURL=CursorCodec.d.ts.map