/**
 * BLAKE3 §2.3 Modes: keyed_hash takes a 32-byte key. The key seeds the chunk
 * machine in place of the BLAKE3 IV and every compress carries the
 * KEYED_HASH flag. A key of any other length is a contract violation.
 */
export declare function validateKey(key: Uint8Array): void;
/**
 * BLAKE3 §2.3 Modes: derive_key takes a context string and produces a
 * derived key. The context string is a domain separator and is
 * conventionally a UTF-8 hardcoded application constant. An empty context
 * defeats the domain separation §2.3 is designed to provide; reject it.
 *
 * Accepts a JS string (UTF-8 encoded here) or a Uint8Array (passed
 * through). No upper cap on length.
 */
export declare function validateContext(context: string | Uint8Array): Uint8Array;
/**
 * BLAKE3 §2.6 XOF: default-length output is 32 bytes; the XOF can in principle
 * produce up to 2^64 - 1 bytes. The one-shot path (BLAKE3.hash /
 * BLAKE3KeyedHash.hash / BLAKE3DeriveKey.derive and the streaming
 * finalize(outLen) counterparts) writes outLen bytes through a single
 * WASM call sized by the OUTPUT_STAGING region, so the practical
 * upper bound is `OUTPUT_STAGING_SIZE` (1024 bytes); larger consumers
 * use `finalizeXof()` and stream from `BLAKE3OutputReader.read(n)`
 * which squeezes 64 bytes at a time off the WASM-side root snapshot.
 * This validator rejects nonsense (zero, negative, non-finite,
 * non-integer); the one-shot wrappers enforce the per-call ceiling.
 */
export declare function validateOutputLen(outLen: number): void;