import type { EncryptionConfig } from './config.js';
import type { DerivationInputFingerprint, KeyDerivationParams } from './types.js';
/**
 * Derives the raw Argon2id hash bytes for the given params/config.
 *
 * Exposed separately from {@link deriveArgon2Key} for the backup self-test's
 * determinism probe: it lets the caller derive twice from identical inputs and
 * diff the results to detect Argon2id non-determinism (suspected on
 * memory-constrained clients). The raw bytes are AES key material and must
 * never be logged or persisted — keep them in-process.
 */
export declare const deriveRawArgon2Bytes: ({ password, salt }: KeyDerivationParams, encryptionConfig: EncryptionConfig) => Promise<Uint8Array>;
/**
 * Derives a key using Argon2id algorithm
 * @param params - Key derivation parameters
 * @param encryptionConfig - Encryption configuration
 * @param onRawKey - In-process hook receiving the raw derived bytes (key material —
 *   never log) and a per-component fingerprint of the inputs that produced them. Lets
 *   the backup self-test reuse the keys it already derives — and prove both sides used
 *   identical inputs (and which component differs if not) — without extra derivations.
 * @returns Promise<CryptoKey>
 */
export declare const deriveArgon2Key: (params: KeyDerivationParams, encryptionConfig: EncryptionConfig, onRawKey?: (rawKey: Uint8Array, inputFingerprint: DerivationInputFingerprint) => void) => Promise<CryptoKey>;
//# sourceMappingURL=argon2.d.ts.map