import { type RecipientKey, encryptToString, encryptBytes, keyId } from './util';
export { keyId };
export { HpkeError, type HpkeErrorCode } from './errors';
/**
 * Create a new AES key for the given public key.
 *
 * @param recipient Public key for decryptor
 * @param opts `size`, `info`, and `extractable`
 * @returns {{ wrapped, key }} The wrapped envelope bytes and the generated
 *   AES-GCM key.
 */
export declare function create(recipient: RecipientKey, opts?: {
    size?: 128 | 256;
    info?: Uint8Array | string;
    extractable?: boolean;
}): Promise<{
    wrapped: Uint8Array<ArrayBufferLike>;
    key: CryptoKey;
}>;
/**
 * Recover the AES key wrapped by `create` or `encryptKey`. Call `open(...)`
 * for a usable AES-GCM `CryptoKey`, or `open.raw(...)` for the raw key bytes.
 */
export declare const open: typeof openBytes & {
    raw: typeof openRawBytes;
};
/**
 * Wrap an AES key to `recipient` and AES-GCM encrypt a message under it.
 * Call `encrypt(...)` for the raw envelope bytes, or `encrypt.asString(...)`
 * for the same envelope as an encoded string.
 */
export declare const encrypt: typeof encryptBytes & {
    asString: typeof encryptToString;
};
/**
 * Recover the AES key from an `encrypt` envelope and AES-GCM decrypt the
 * message. Call `decrypt(...)` for the plaintext bytes,
 * `decrypt.asString(...)` to UTF-8 decode them to a string, or
 * `decrypt.fromString(...)` to decrypt a `base64url`-encoded envelope
 * string (from `encrypt.asString`).
 */
export declare const decrypt: typeof decryptBytes & {
    asString: typeof decryptToString;
    fromString: typeof decryptFromString;
};
/**
 * Recover the AES key from an envelope produced by `encrypt`, then AES-GCM
 * decrypt the message.
 *
 * @param keypair The same recipient `CryptoKeyPair` used to `encrypt`.
 * @param message The envelope returned by `encrypt`.
 * @param opts `info` -- must match the value passed to `encrypt`.
 * @returns The decrypted plaintext bytes. Use `decrypt.asString` for a string.
 */
declare function decryptBytes(keypair: CryptoKeyPair, message: Uint8Array, opts?: {
    info?: Uint8Array | string;
}): Promise<Uint8Array>;
/**
 * Like `decrypt`, but UTF-8 decodes the plaintext to a string. Only use this
 * when the original message was text. Exposed as `decrypt.asString`.
 *
 * @param keypair The same recipient `CryptoKeyPair` used to `encrypt`.
 * @param message The envelope returned by `encrypt`.
 * @param opts `info` -- must match the value passed to `encrypt`.
 * @returns The decrypted plaintext as a string.
 */
declare function decryptToString(keypair: CryptoKeyPair, message: Uint8Array, opts?: {
    info?: Uint8Array | string;
}): Promise<string>;
/**
 * Decode a `base64url` string envelope (from `encrypt.asString`),
 * recover the AES key, and AES-GCM decrypt the message. Exposed as
 * `decrypt.fromString`.
 *
 * @param keypair The same recipient `CryptoKeyPair` used to `encrypt`.
 * @param message The `base64url`-encoded envelope string, as returned
 *   by `encrypt.asString`.
 * @param opts `info` (must match `encrypt`), and `buffer` -- if true,
 *   return the raw plaintext `Uint8Array` instead of a UTF-8 decoded
 *   string.
 * @returns The decrypted plaintext, as a string (default) or
 *   `Uint8Array` (if `opts.buffer` is true).
 */
declare function decryptFromString(keypair: CryptoKeyPair, message: string, opts?: {
    info?: Uint8Array | string;
    buffer?: false;
}): Promise<string>;
declare function decryptFromString(keypair: CryptoKeyPair, message: string, opts: {
    info?: Uint8Array | string;
    buffer: true;
}): Promise<Uint8Array>;
/**
 * Like `open`, but returns the recovered key as raw bytes instead of
 * importing it as an AES-GCM `CryptoKey`. Exposed as `open.raw`.
 *
 * @param keypair The same X25519 `CryptoKeyPair` used to create or encryptKey.
 * @param wrapped The `wrapped` bytes returned by `create` or `encryptKey`.
 * @param opts `info` -- must match the value passed to `create` or
 *   `encryptKey`.
 * @returns The recovered key bytes (16 or 32 bytes, matching whatever
 *   was wrapped).
 */
declare function openRawBytes(keypair: CryptoKeyPair, wrapped: Uint8Array, opts?: {
    info?: Uint8Array | string;
}): Promise<Uint8Array>;
/**
 * Recover an AES key that was wrapped with `create` or `encryptKey`.
 *
 * @param keypair The same X25519 `CryptoKeyPair` used to create or encryptKey.
 * @param wrapped The `wrapped` bytes returned by `create` or `encryptKey`.
 * @param opts `info` -- must match the value passed to `create` or
 *   `encryptKey` -- and `extractable` (default false).
 * @returns The recovered AES-GCM `CryptoKey`, non-extractable unless
 *   `opts.extractable` is true.
 */
declare function openBytes(keypair: CryptoKeyPair, wrapped: Uint8Array, opts?: {
    info?: Uint8Array | string;
    extractable?: boolean;
}): Promise<CryptoKey>;
/**
 * Wrap an AES key to a recipient's public key. `create(...)` calls this
 * helper with no `aesKey`, so it generates a fresh AES key first.
 *
 * @param recipient The recipient's X25519 public key, as a `CryptoKey`,
 *   `CryptoKeyPair` (its `.publicKey` is used), 32 raw bytes (`Uint8Array`),
 *   or `{ publicKey:string, encoding? }` (encoding defaults to `base64url`).
 * @param aesKey Optional key to wrap, as either an AES-GCM `CryptoKey` or its
 *   raw bytes (`Uint8Array`, 16 or 32 bytes). Omit to generate a fresh key
 *   of `opts.size` bits. A supplied `CryptoKey` MUST be extractable (its
 *   raw bytes are wrapped) -- that is an input constraint, unrelated to
 *   `opts.extractable`, which governs the key this returns.
 * @param opts `size` (128/256, default 256; ignored when `aesKey` is
 *   supplied), `info` (bound into the HPKE key schedule; default empty),
 *   and `extractable` (whether the RETURNED key can be exported; default
 *   false).
 * @returns { wrapped:Uint8Array, key:CryptoKey } The wrapped envelope
 *   bytes and a usable AES-GCM `CryptoKey`.
 */
export declare function encryptKey(recipient: RecipientKey, aesKey?: CryptoKey | Uint8Array | null, opts?: {
    size?: 128 | 256;
    info?: Uint8Array | string;
    extractable?: boolean;
}): Promise<{
    wrapped: Uint8Array;
    key: CryptoKey;
}>;
//# sourceMappingURL=index.d.ts.map