export { pkcs7Pad, pkcs7Strip, PKCS7_INVALID } from '../shared/pkcs7.js';
/** Subset of the sha2 WASM exports used by `hmacSha256`. */
export interface Sha2OpsExports {
    memory: WebAssembly.Memory;
    getSha256InputOffset: () => number;
    getSha256OutOffset: () => number;
    sha256Init: () => void;
    sha256Update: (len: number) => void;
    sha256Final: () => void;
    hmac256Init: (keyLen: number) => void;
    hmac256Update: (len: number) => void;
    hmac256Final: () => void;
}
/** Subset of the serpent WASM exports used by `cbcEncryptChunk`/`cbcDecryptChunk`. */
export interface SerpentOpsExports {
    memory: WebAssembly.Memory;
    getKeyOffset: () => number;
    getChunkPtOffset: () => number;
    getChunkCtOffset: () => number;
    getChunkSize: () => number;
    getCbcIvOffset: () => number;
    loadKey: (n: number) => number;
    cbcEncryptChunk: (n: number) => number;
    cbcDecryptChunk_simd: (n: number) => number;
    wipeBuffers: () => void;
}
/**
 * Compute HMAC-SHA-256 using raw WASM sha2 exports.
 *
 * Keys longer than 64 bytes are pre-hashed per RFC 2104 §3. The SHA-256
 * input buffer is fed in 64-byte chunks to match the WASM block size.
 * Does not call `_acquireModule`, callers must ensure no stateful instance
 * owns the sha2 module before calling.
 * @param sx   sha2 WASM exports
 * @param key  HMAC key of any length
 * @param msg  Message to authenticate
 * @returns    32-byte HMAC-SHA-256 tag
 */
export declare function hmacSha256(sx: Sha2OpsExports, key: Uint8Array, msg: Uint8Array): Uint8Array;
/**
 * Encrypt one plaintext chunk with Serpent-256 CBC + PKCS7 padding.
 *
 * The padded chunk must fit within the WASM CHUNK_SIZE. Callers are
 * responsible for splitting larger payloads before calling.
 * @param kx     Serpent WASM exports
 * @param key    16, 24, or 32-byte key
 * @param iv     16-byte CBC initialisation vector
 * @param chunk  Plaintext chunk (padded length must be ≤ WASM CHUNK_SIZE)
 * @returns      Ciphertext with PKCS7 padding applied
 */
export declare function cbcEncryptChunk(kx: SerpentOpsExports, key: Uint8Array, iv: Uint8Array, chunk: Uint8Array): Uint8Array;
/**
 * Decrypt one Serpent-256 CBC chunk using the SIMD path and strip PKCS7 padding.
 *
 * Output matches `SerpentCbc.decrypt` byte-for-byte. Throws
 * `RangeError('invalid ciphertext')` on any length or padding failure.
 * @param kx   Serpent WASM exports
 * @param key  16, 24, or 32-byte key
 * @param iv   16-byte CBC initialisation vector
 * @param ct   Ciphertext (must be non-empty and a multiple of 16 bytes)
 * @returns    Plaintext with PKCS7 padding removed
 */
export declare function cbcDecryptChunk(kx: SerpentOpsExports, key: Uint8Array, iv: Uint8Array, ct: Uint8Array): Uint8Array;