import type { WasmSource } from '../wasm-source.js';
/**
 * Load and initialise the Serpent WASM module from `source`.
 * Must be called before constructing any Serpent class.
 * @param source  WASM binary, gzip+base64 string, URL, ArrayBuffer, Uint8Array,
 *                pre-compiled WebAssembly.Module, Response, or Promise<Response>
 */
export declare function serpentInit(source: WasmSource): Promise<void>;
export type { WasmSource };
export { isInitialized } from '../init.js';
/**
 * Low-level Serpent-256 block cipher, raw ECB encrypt/decrypt.
 *
 * Atomic (stateless) class: each method call is independent.
 * Does not hold exclusive module access; cannot be used while a stateful
 * instance (`SerpentCtr`, `SerpentCbc`, `SerpentCipher`) is alive.
 * Call `dispose()` after use to wipe WASM key material.
 */
export declare class Serpent {
    private readonly x;
    constructor();
    /**
     * Expand `key` into the WASM key schedule. Must be called before
     * `encryptBlock` / `decryptBlock`.
     * @param key  16, 24, or 32 bytes
     */
    loadKey(key: Uint8Array): void;
    /**
     * Encrypt one 128-bit block with the previously loaded key schedule.
     * Serpent AES submission §2.2.
     * @param plaintext  16-byte plaintext block
     * @returns          16-byte ciphertext block
     */
    encryptBlock(plaintext: Uint8Array): Uint8Array;
    /**
     * Decrypt one 128-bit block with the previously loaded key schedule.
     * Serpent AES submission §2.2.
     * @param ciphertext  16-byte ciphertext block
     * @returns           16-byte plaintext block
     */
    decryptBlock(ciphertext: Uint8Array): Uint8Array;
    /** Wipe WASM key material and release memory. */
    dispose(): void;
}
/**
 * Serpent-256 in CTR mode.
 *
 * **WARNING: CTR mode is unauthenticated.** An attacker can flip ciphertext
 * bits without detection. Always pair with HMAC-SHA256 (Encrypt-then-MAC)
 * or use `XChaCha20Poly1305` instead.
 *
 * Holds exclusive access to the `serpent` WASM module from construction
 * until `dispose()`. Constructing a second SerpentCtr/SerpentCbc/
 * SerpentCipher or any other serpent user while this instance is live
 * throws. Call `dispose()` when done.
 */
export declare class SerpentCtr {
    private readonly x;
    private _tok;
    constructor(opts?: {
        dangerUnauthenticated: true;
    });
    /**
     * Load key and nonce into WASM state and reset the block counter to 0.
     * Must be called before each message.
     * @param key    16, 24, or 32 bytes
     * @param nonce  16 bytes, must be unique per (key, message)
     */
    beginEncrypt(key: Uint8Array, nonce: Uint8Array): void;
    /**
     * XOR `chunk` with the next keystream block(s). Counter advances automatically.
     * @param chunk  Plaintext chunk, must not exceed WASM CHUNK_SIZE
     * @returns      Ciphertext of the same length
     */
    encryptChunk(chunk: Uint8Array): Uint8Array;
    /**
     * Alias for `beginEncrypt`, CTR mode is symmetric.
     * @param key    16, 24, or 32 bytes
     * @param nonce  16 bytes, must match the value used to encrypt
     */
    beginDecrypt(key: Uint8Array, nonce: Uint8Array): void;
    /**
     * Alias for `encryptChunk`, CTR mode is symmetric.
     * @param chunk  Ciphertext chunk
     * @returns      Plaintext of the same length
     */
    decryptChunk(chunk: Uint8Array): Uint8Array;
    /** Wipe WASM state and release exclusive module access. Idempotent. */
    dispose(): void;
}
export { SerpentCbc } from './serpent-cbc.js';
export { AuthenticationError } from '../errors.js';
export { SerpentCipher } from './cipher-suite.js';
export { SerpentGenerator } from './generator.js';