import type { CryptoBackend } from './backend.js';
import type { Bytes32, MessageHash, PrivateKey, PublicKey, SchnorrSignature, Signature, XOnlyPublicKey } from './branded.js';
import { SignerCapability } from './capability.js';
import type { Network } from './networks.js';
/**
 * Minimal synchronous signer interface.
 *
 * Consumers that only need ECDSA signing can depend on this rather than the
 * full {@link UniversalSigner}.
 */
export interface Signer {
    /** SEC1-encoded public key (33 or 65 bytes). */
    readonly publicKey: PublicKey;
    /** Network this signer is bound to, if any. */
    readonly network?: Network | undefined;
    /**
     * Produces a compact ECDSA signature over `hash`.
     * @param hash - 32-byte message digest.
     * @param lowR - When `true`, grinds for a low-R value (smaller DER encoding).
     */
    sign(hash: MessageHash, lowR?: boolean): Signature;
    /**
     * Produces a BIP-340 Schnorr signature over `hash`.
     * @param hash - 32-byte message digest.
     */
    signSchnorr?(hash: MessageHash): SchnorrSignature;
}
/**
 * Asynchronous counterpart of {@link Signer} for hardware wallets or
 * remote signing services.
 */
export interface SignerAsync {
    /** SEC1-encoded public key (33 or 65 bytes). */
    readonly publicKey: PublicKey;
    /** Network this signer is bound to, if any. */
    readonly network?: Network | undefined;
    /**
     * Produces a compact ECDSA signature over `hash`.
     * @param hash - 32-byte message digest.
     * @param lowR - When `true`, grinds for a low-R value.
     */
    sign(hash: MessageHash, lowR?: boolean): Promise<Signature>;
    /**
     * Produces a BIP-340 Schnorr signature over `hash`.
     * @param hash - 32-byte message digest.
     */
    signSchnorr?(hash: MessageHash): Promise<SchnorrSignature>;
}
/**
 * Synchronous hierarchical-deterministic signer.
 *
 * Suitable for BIP-32 key pairs that can derive children and produce
 * raw ECDSA signatures (no low-R grinding, no branded return type).
 */
export interface HDSigner {
    /** SEC1-encoded public key (33 or 65 bytes). */
    readonly publicKey: PublicKey;
    /** The first 4 bytes of the sha256-ripemd160 of the publicKey. */
    readonly fingerprint: Uint8Array;
    /**
     * Derives a child signer from a BIP-32 path.
     * @param path - BIP-32 derivation path (e.g. `m/44'/0'/0'/1/23`).
     */
    derivePath(path: string): HDSigner;
    /**
     * Produces a 64-byte compact ECDSA signature over `hash`.
     * @param hash - 32-byte message digest.
     */
    sign(hash: MessageHash): Uint8Array;
}
/**
 * Asynchronous counterpart of {@link HDSigner} for hardware wallets or
 * remote signing services.
 */
export interface HDSignerAsync {
    /** SEC1-encoded public key (33 or 65 bytes). */
    readonly publicKey: PublicKey;
    /** The first 4 bytes of the sha256-ripemd160 of the publicKey. */
    readonly fingerprint: Uint8Array;
    /**
     * Derives a child signer from a BIP-32 path.
     * @param path - BIP-32 derivation path (e.g. `m/44'/0'/0'/1/23`).
     */
    derivePath(path: string): HDSignerAsync;
    /**
     * Produces a 64-byte compact ECDSA signature over `hash`.
     * @param hash - 32-byte message digest.
     */
    sign(hash: MessageHash): Promise<Uint8Array>;
}
/**
 * Full-featured signer interface exposing every operation that
 * {@link ECPairSigner} supports.
 */
export interface UniversalSigner extends Signer {
    /** 32-byte BIP-340 x-only public key. */
    readonly xOnlyPublicKey: XOnlyPublicKey;
    /** Network this signer is bound to. */
    readonly network: Network;
    /** Whether the public key is in compressed SEC1 form. */
    readonly compressed: boolean;
    /** Bitmask of {@link SignerCapability} flags. */
    readonly capabilities: number;
    /** Raw private key bytes, or `undefined` for public-key-only signers. */
    readonly privateKey?: PrivateKey | undefined;
    /**
     * Tests whether the signer has a specific capability.
     * @param cap - {@link SignerCapability} flag to test.
     */
    hasCapability(cap: SignerCapability): boolean;
    /**
     * Verifies a compact ECDSA signature.
     * @param hash - 32-byte message digest.
     * @param signature - Compact ECDSA signature.
     */
    verify(hash: MessageHash, signature: Signature): boolean;
    /**
     * Verifies a BIP-340 Schnorr signature.
     * @param hash - 32-byte message digest.
     * @param signature - 64-byte Schnorr signature.
     */
    verifySchnorr(hash: MessageHash, signature: SchnorrSignature): boolean;
    /**
     * Derives a new signer by applying a Taproot-style scalar tweak.
     * @param t - 32-byte tweak scalar.
     */
    tweak(t: Bytes32): UniversalSigner;
    /**
     * Exports the private key as a WIF string.
     * @throws If this is a public-key-only signer.
     */
    toWIF(): string;
}
/**
 * Options shared by all {@link ECPairSigner} factory methods.
 */
export interface SignerOptions {
    /**
     * Whether to use compressed SEC1 encoding for the public key.
     * Defaults to `true`.
     */
    readonly compressed?: boolean | undefined;
}
/**
 * Options for {@link ECPairSigner.makeRandom}, extending {@link SignerOptions}
 * with an optional custom RNG.
 */
export interface RandomSignerOptions extends SignerOptions {
    /**
     * Custom random-byte generator.  Must return exactly `size` bytes.
     * Falls back to `crypto.getRandomValues` when omitted.
     */
    readonly rng?: ((size: number) => Uint8Array) | undefined;
}
/**
 * Concrete secp256k1 key-pair signer backed by a {@link CryptoBackend}.
 *
 * Instances are created exclusively through the static factory methods
 * ({@link ECPairSigner.fromPrivateKey}, {@link ECPairSigner.fromPublicKey},
 * {@link ECPairSigner.fromWIF}, {@link ECPairSigner.makeRandom}).
 *
 * @example
 * ```ts
 * import { ECPairSigner, createNobleBackend } from 'ecpair';
 *
 * const backend = createNobleBackend();
 * const signer  = ECPairSigner.makeRandom(backend, bitcoin);
 * const sig     = signer.sign(messageHash);
 * ```
 */
export declare class ECPairSigner implements UniversalSigner {
    #private;
    private constructor();
    private constructor();
    /** Raw private key bytes, or `undefined` for public-key-only signers. */
    get privateKey(): PrivateKey | undefined;
    /**
     * SEC1-encoded public key.  Lazily derived from the private key when
     * the signer was created via {@link fromPrivateKey} or {@link fromWIF}.
     *
     * @throws If neither a private nor public key is available (should never happen).
     */
    get publicKey(): PublicKey;
    /** 32-byte BIP-340 x-only public key (lazily derived and cached). */
    get xOnlyPublicKey(): XOnlyPublicKey;
    /** Network this signer is bound to. */
    get network(): Network;
    /** Whether the public key is in compressed SEC1 form. */
    get compressed(): boolean;
    /**
     * Bitmask of {@link SignerCapability} flags representing the operations
     * this signer can perform.  Lazily computed and cached.
     */
    get capabilities(): number;
    /**
     * Creates a signer from a raw private key.
     *
     * @param backend - Cryptographic backend to use.
     * @param privateKey - 32-byte secp256k1 private key.
     * @param network - Target network.
     * @param options - Optional settings (e.g. compressed).
     * @throws {TypeError} If the private key is not in the valid range `[1, n)`.
     */
    static fromPrivateKey(backend: CryptoBackend, privateKey: PrivateKey, network: Network, options?: SignerOptions): ECPairSigner;
    /**
     * Creates a public-key-only signer (cannot sign, export WIF, etc.).
     *
     * @param backend - Cryptographic backend to use.
     * @param publicKey - SEC1-encoded public key.
     * @param network - Target network.
     * @param options - Optional settings (e.g. compressed).
     * @throws If the public key is not a valid curve point.
     */
    static fromPublicKey(backend: CryptoBackend, publicKey: PublicKey, network: Network, options?: SignerOptions): ECPairSigner;
    /**
     * Imports a signer from a WIF-encoded private key string.
     *
     * @param backend - Cryptographic backend to use.
     * @param wifString - Base58Check WIF string.
     * @param network - One or more candidate networks whose WIF version byte is matched.
     * @throws If no network matches the decoded version byte.
     */
    static fromWIF(backend: CryptoBackend, wifString: string, network: Network | readonly Network[]): ECPairSigner;
    /**
     * Generates a new signer with a random private key.
     *
     * Uses FIPS 186-5 B.4.2 / RFC 9380 modular reduction:
     * 48 bytes of entropy are reduced via `(seed mod (n − 1)) + 1`,
     * producing a key in `[1, n)` with negligible bias (< 2^−128).
     *
     * @param backend - Cryptographic backend to use.
     * @param network - Target network.
     * @param options - Optional settings (rng, compressed).
     */
    static makeRandom(backend: CryptoBackend, network: Network, options?: RandomSignerOptions): ECPairSigner;
    /**
     * Tests whether this signer has a specific capability.
     * @param cap - {@link SignerCapability} flag to test.
     */
    hasCapability(cap: SignerCapability): boolean;
    /**
     * Produces a compact ECDSA signature.
     *
     * When `lowR` is `true`, grinds the nonce until the R value's first
     * byte is `<= 0x7f`, producing a smaller DER encoding.
     *
     * @param hash - 32-byte message digest.
     * @param lowR - Enable low-R grinding.  Defaults to `false`.
     * @throws If this is a public-key-only signer.
     */
    sign(hash: MessageHash, lowR?: boolean): Signature;
    /**
     * Produces a 64-byte BIP-340 Schnorr signature.
     *
     * @param hash - 32-byte message digest.
     * @throws If this is a public-key-only signer.
     * @throws If the backend does not support Schnorr signing.
     */
    signSchnorr(hash: MessageHash): SchnorrSignature;
    /**
     * Verifies a compact ECDSA signature against this signer's public key.
     *
     * @param hash - 32-byte message digest.
     * @param signature - Compact ECDSA signature.
     */
    verify(hash: MessageHash, signature: Signature): boolean;
    /**
     * Verifies a BIP-340 Schnorr signature against this signer's x-only public key.
     *
     * @param hash - 32-byte message digest.
     * @param signature - 64-byte Schnorr signature.
     * @throws If the backend does not support Schnorr verification.
     */
    verifySchnorr(hash: MessageHash, signature: SchnorrSignature): boolean;
    /**
     * Derives a new signer by applying a Taproot-style scalar tweak.
     *
     * When a private key is available the tweak is applied to the scalar
     * (negating first if the public key has odd Y).  Otherwise, only the
     * public key is tweaked via x-only point addition.
     *
     * @param t - 32-byte tweak scalar.
     * @throws If the tweaked key is invalid (e.g. lands on the point at infinity).
     */
    tweak(t: Bytes32): ECPairSigner;
    /**
     * Exports the private key as a WIF string using this signer's network.
     *
     * @throws If this is a public-key-only signer.
     */
    toWIF(): string;
}
//# sourceMappingURL=signer.d.ts.map