/**
 * ECDH key exchange and session encryption for peer-to-peer channels.
 *
 * Uses X25519 for key agreement and AES-256-GCM for message encryption.
 * Session keys are derived via HKDF-SHA256 from the ECDH shared secret
 * and a caller-provided nonce (to ensure per-session uniqueness).
 *
 * Wire format for encrypted messages (base64 encoded):
 *   IV (12 bytes) || AuthTag (16 bytes) || Ciphertext
 */
import { type KeyObject } from 'node:crypto';
/**
 * An X25519 key pair for ECDH key exchange.
 * The public key is DER SPKI-encoded for wire transport.
 */
export interface EcdhKeyPair {
    /** DER SPKI-encoded X25519 public key. */
    publicKey: Buffer;
    /** X25519 private key object (not exported to wire). */
    privateKey: KeyObject;
}
/**
 * Generate a new X25519 key pair for ECDH key exchange.
 *
 * @returns Key pair with DER SPKI public key and KeyObject private key
 */
export declare function generateEcdhKeyPair(): EcdhKeyPair;
/**
 * Derive a 32-byte AES-256 session key from an ECDH key exchange.
 *
 * Performs X25519 Diffie-Hellman, then derives the session key via
 * HKDF-SHA256 with the provided nonce as salt.
 *
 * @param localPrivateKey - This node's X25519 private key
 * @param remotePubKeyDer - Remote node's DER SPKI-encoded X25519 public key
 * @param nonce - Random nonce (used as HKDF salt for per-session uniqueness)
 * @returns 32-byte session key suitable for AES-256-GCM
 */
export declare function deriveSessionKey(localPrivateKey: KeyObject, remotePubKeyDer: Buffer, nonce: Buffer): Buffer;
/**
 * Encrypt a plaintext message with a session key using AES-256-GCM.
 *
 * @param plaintext - The message to encrypt
 * @param sessionKey - 32-byte session key from deriveSessionKey
 * @returns Base64-encoded string: IV (12) || AuthTag (16) || Ciphertext
 */
export declare function encryptMessage(plaintext: string, sessionKey: Buffer): string;
/**
 * Decrypt a message encrypted with encryptMessage.
 *
 * @param encrypted - Base64-encoded string: IV (12) || AuthTag (16) || Ciphertext
 * @param sessionKey - 32-byte session key (must match the key used for encryption)
 * @returns Decrypted plaintext string
 * @throws If the session key is wrong or the ciphertext has been tampered with
 */
export declare function decryptMessage(encrypted: string, sessionKey: Buffer): string;
//# sourceMappingURL=peer-crypto.d.ts.map