import { PdfValue } from './objects.js';
/** The user-access permission flags (`/P`, §7.6.4.4.7); each defaults to allowed. */
export interface PdfPermissions {
    /** Bit 3 — print the document (default true). */
    readonly printing?: boolean;
    /** Bit 4 — modify contents (default true). */
    readonly modifying?: boolean;
    /** Bit 5 — copy text and graphics (default true). */
    readonly copying?: boolean;
    /** Bit 6 — add/modify annotations (default true). */
    readonly annotating?: boolean;
    /** Bit 9 — fill in form fields (default true). */
    readonly fillingForms?: boolean;
    /** Bit 10 — extraction for accessibility (default true; forced by PDF/UA). */
    readonly contentAccessibility?: boolean;
    /** Bit 11 — assemble (insert/rotate/delete pages) (default true). */
    readonly documentAssembly?: boolean;
}
/** Passwords and permissions for {@link preparePdfEncryption}. */
export interface PdfEncryptOptions {
    /** Required to OPEN the document. Empty string = opens without a prompt. */
    readonly userPassword?: string;
    /** Overrides the permission restrictions. Defaults to the user password. */
    readonly ownerPassword?: string;
    readonly permissions?: PdfPermissions;
}
/** The output of {@link preparePdfEncryption}: the file key plus the `/Encrypt` dictionary. */
export interface PreparedEncryption {
    /** 32-byte file encryption key (FEK) — encrypts every string/stream. */
    readonly fileKey: Uint8Array;
    readonly encryptDict: PdfValue;
}
/**
 * Compute the `/P` permission integer (§7.6.4.4.7) from the high-level flags:
 * bits 1–2 are reserved 0 and undefined bits are 1, so all-permissions is
 * `0xFFFFFFFC` (-4 as int32); each disabled flag clears its bit.
 *
 * @param p The permission flags, or `undefined` for all-allowed.
 * @returns The signed 32-bit `/P` value.
 */
export declare function permissionBits(p: PdfPermissions | undefined): number;
/**
 * AES-CBC decryption without padding, the inverse of the internal no-pad
 * encrypt. Appends a crafted padding block so WebCrypto's PKCS7 unpad succeeds
 * and returns exactly `data.length` plain bytes.
 *
 * @param key  The 16-byte AES key.
 * @param iv   The initialization vector.
 * @param data The ciphertext (a 16-byte multiple).
 * @returns The decrypted bytes.
 */
export declare function aesCbcNoPadDecrypt(key: Uint8Array, iv: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
/**
 * The iterated hash hardening of Algorithm 2.B (§7.6.4.3.4): SHA-256/384/512
 * rounds interleaved with AES-CBC, run to the spec's stopping condition.
 *
 * @param password The (truncated) password bytes.
 * @param salt     The validation or key salt.
 * @param userData Additional hash input (the 48-byte `/U` for owner derivation,
 *   empty otherwise).
 * @returns The derived 32-byte key.
 */
export declare function hardHash(password: Uint8Array, salt: Uint8Array, userData: Uint8Array): Promise<Uint8Array>;
/**
 * Build the V5/R6 (AES-256) Standard-security-handler `/Encrypt` dictionary:
 * derive `/U`, `/UE`, `/O`, `/OE` and `/Perms` (§7.6.4.4.8–.10, Algorithms
 * 8–10) for a freshly-generated random file encryption key.
 *
 * @param options The passwords and permissions.
 * @returns The file key and the `/Encrypt` dictionary ({@link PreparedEncryption}).
 */
export declare function preparePdfEncryption(options: PdfEncryptOptions): Promise<PreparedEncryption>;
/**
 * Decrypt AESV3 content (§7.6.3.3): split the leading 16-byte IV and
 * AES-256-CBC-decrypt the remainder.
 *
 * @param fileKey The 32-byte file encryption key.
 * @param data    The `IV ‖ ciphertext` bytes.
 * @returns The decrypted plaintext.
 */
export declare function decryptBytes(fileKey: Uint8Array, data: Uint8Array): Promise<Uint8Array>;
/**
 * Recursively encrypt every string and stream in an object graph (AESV3). The
 * `/Encrypt` dictionary itself is added AFTER this pass and never encrypted, and
 * trailer `/ID` strings live outside the body. Strings come back as hex strings,
 * since the cipher bytes are binary; numbers, booleans, names, refs, null and
 * raw tokens pass through unchanged.
 *
 * @param value   The value to walk.
 * @param fileKey The 32-byte file encryption key.
 * @returns The value with its strings/streams replaced by their ciphertext.
 */
export declare function encryptObjectGraph(value: PdfValue, fileKey: Uint8Array): Promise<PdfValue>;