import { MlsContext } from "./mls.js";
/**
 * SFrame ciphersuite.
 *
 * * `0` — AES-128-GCM (16-byte key). Default.
 * * `1` — AES-256-GCM (32-byte key).
 */
export type SFrameCipherSuite = 0 | 1;
export declare const AES_128_GCM: SFrameCipherSuite;
export declare const AES_256_GCM: SFrameCipherSuite;
/**
 * Result returned by {@link SFrameSession.decrypt}.
 */
export interface SFrameDecryptResult {
    /** Decrypted Opus frame. */
    plaintext: Buffer;
    /** MLS leaf index of the sender. */
    senderLeaf: number;
}
/**
 * SFrame E2EE session for one MLS epoch.
 *
 * Derives `sframe_base_key` from the MLS `ExportSecret` and provides
 * {@link createEncryptor} and {@link decrypt} for send and receive paths.
 *
 * Create a new session after every MLS commit (epoch change).
 *
 * @example
 * ```ts
 * const session = SFrameSession.create(mls, "gbp/sframe v1");
 * const enc = session.createEncryptor(mls, myLeafIndex);
 *
 * // Sender side:
 * const payload = enc.encrypt(opusFrame);
 *
 * // Receiver side:
 * const { plaintext, senderLeaf } = session.decrypt(payload);
 * ```
 */
export declare class SFrameSession {
    private readonly handle;
    private constructor();
    /**
     * Creates an SFrame session from the current MLS context.
     *
     * @param mls     The active MLS context.
     * @param label   Export label, e.g. `"gbp/sframe v1"`.
     * @param suite   Ciphersuite — `AES_128_GCM` (default) or `AES_256_GCM`.
     */
    static create(mls: MlsContext, label?: string, suite?: SFrameCipherSuite): SFrameSession;
    /**
     * Creates a per-sender {@link SFrameEncryptor} for `leafIndex`.
     *
     * The encryptor holds the derived key+salt for this sender and maintains an
     * internal counter.  **Do not share across threads.**
     *
     * @param mls       Must be the same MLS context used in {@link create}.
     * @param leafIndex The local sender's MLS leaf index.
     * @param label     Must match the label used in {@link create}.
     * @param suite     Must match the suite used in {@link create}.
     */
    createEncryptor(mls: MlsContext, leafIndex: number, label?: string, suite?: SFrameCipherSuite): SFrameEncryptor;
    /**
     * Decrypts one SFrame payload.
     *
     * @param payload  Full SFrame payload (header + ciphertext + tag).
     * @param extraAad Additional authenticated data passed on the sender side;
     *                 empty `Buffer` or `undefined` if none.
     */
    decrypt(payload: Buffer, extraAad?: Buffer): SFrameDecryptResult;
    /** Frees the native session handle. */
    close(): void;
    [Symbol.dispose](): void;
}
/**
 * Stateful per-sender SFrame encryptor.
 *
 * Maintains an internal counter that increments on every {@link encrypt} call.
 * Obtain via {@link SFrameSession.createEncryptor}.
 */
export declare class SFrameEncryptor {
    private readonly handle;
    constructor(handle: number);
    /**
     * Encrypts one audio frame.
     *
     * @param plaintext Raw Opus frame bytes.
     * @param extraAad  Additional authenticated data; pass `undefined` or an
     *                  empty `Buffer` if none.
     * @returns SFrame payload: `sframe_header ‖ ciphertext ‖ GCM-tag`.
     */
    encrypt(plaintext: Buffer, extraAad?: Buffer): Buffer;
    /** Frees the native encryptor handle. */
    close(): void;
    [Symbol.dispose](): void;
}
//# sourceMappingURL=sframe.d.ts.map