import type { AesExports } from './types.js';
/**
 * AES-256-GCM-SIV AEAD encrypt (RFC 8452). Single-shot per call; the
 * plaintext is bounded by the AES module's WASM CHUNK_SIZE.
 *
 * Stage: write KGK at KEY_OFFSET, expand round keys, write nonce/AAD/PT
 * into their slots, run `sivDeriveKeys(NONCE_OFFSET)`, then `sivSeal`.
 * `sivSeal` overwrites CHUNK_PT with the ciphertext in place; the tag
 * lands at TAG_OFFSET.
 *
 * @note AES-256 only, the key MUST be 32 bytes. The standalone
 *       `AESGCMSIV` class accepts both 16-byte (AES-128) and 32-byte
 *       (AES-256) keys per RFC 8452 §6, but this `ops.ts` path is the
 *       internal helper for `AESGCMSIVCipher` and the AES pool worker,
 *       both of which fix the cipher suite at AES-256 to keep the wire
 *       format uniform across deployments. A 16-byte key here throws
 *       `RangeError('AES-GCM-SIV: key must be 32 bytes (got 16)')`. Use
 *       the `AESGCMSIV` class directly if you need AES-128.
 *
 * @param x          AES WASM exports
 * @param key        32-byte AES-256 key (KGK in RFC 8452 terminology)
 * @param nonce      12-byte nonce, must be unique per `(key, message)`
 *                   under the standard nonce-respecting model; reuse is
 *                   tolerated by the SIV construction but reduces IND-CPA
 *                   to message-equality leakage
 * @param plaintext  Data to encrypt; must be ≤ `x.getChunkSize()`
 * @param aad        Additional authenticated data; must be ≤ 64 KiB
 * @returns          `{ ciphertext, tag }`, tag is 16 bytes
 */
export declare function sivAeadEncrypt(x: AesExports, key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): {
    ciphertext: Uint8Array;
    tag: Uint8Array;
};
/**
 * AES-256-GCM-SIV AEAD decrypt (RFC 8452). Verify-after-decrypt, the
 * tag is a function of the plaintext, so SIV reconstructs the plaintext
 * before recomputing and comparing the tag in constant time.
 *
 * On mismatch, `sivWipeOnFail()` zeroes the unauthenticated plaintext at
 * CHUNK_PT_OFFSET before this function throws. Subsequent reads of
 * the WASM memory cannot recover plaintext from a forged ciphertext.
 *
 * @note AES-256 only, the key MUST be 32 bytes (matching
 *       `sivAeadEncrypt`). The standalone `AESGCMSIV` class supports
 *       both AES-128 and AES-256, but this `ops.ts` helper is the
 *       internal path used by `AESGCMSIVCipher` and the AES pool
 *       worker, both of which fix the cipher suite at AES-256. A
 *       16-byte key here throws
 *       `RangeError('AES-GCM-SIV: key must be 32 bytes (got 16)')`.
 *
 * @param x           AES WASM exports
 * @param key         32-byte AES-256 key
 * @param nonce       12-byte nonce, must match the value used to encrypt
 * @param ciphertext  Ciphertext bytes (must be ≤ `x.getChunkSize()`)
 * @param tag         16-byte SIV tag
 * @param aad         Additional authenticated data
 * @param cipherName  Error label for `AuthenticationError` (default 'aes-gcm-siv')
 * @returns           Plaintext
 */
export declare function sivAeadDecrypt(x: AesExports, key: Uint8Array, nonce: Uint8Array, ciphertext: Uint8Array, tag: Uint8Array, aad: Uint8Array, cipherName?: string): Uint8Array;