import { Decryptor, Encryptor, XwingScheme } from '../encryption/encryption.js';
import { PubKeyEncodable } from '../reencryption/index.js';
/**
 * X-Wing public key size in bytes.
 * Combining ML-KEM-768 (1184 bytes) and X25519 (32 bytes).
 */
export declare const XWING_PUBLIC_KEY_SIZE: number;
/**
 * WARNING: TEST KEY - DO NOT USE IN PRODUCTION
 * This is a well-known test seed (all zeros) that provides NO security.
 * Anyone can derive the private key from this seed and decrypt all data.
 * Only use for local development and testing.
 */
export declare const TEST_NETWORK_SEED_KEY = "0x0000000000000000000000000000000000000000000000000000000000000000";
/**
 * WARNING: TEST KEY - DO NOT USE IN PRODUCTION
 * This is the public key derived from TEST_NETWORK_SEED_KEY (all zeros).
 * Data encrypted with this key can be decrypted by anyone who knows the seed.
 * Only use for local development and testing.
 *
 * Generated from Go with seed of all zeros using HPKE layer: hpke.KEM_XWING.Scheme().DeriveKeyPair(seed)
 * This matches the key used in covalidator's GetXwingPrivateKeyForTesting() via DeriveXwingPrivateKey
 */
export declare const TEST_NETWORK_XWING_PUBKEY = "0xca882388911c7c762aafc20debd63e845b3bed28c9d5262cdea7771fb31bd660a1ae7b395a9a7df3d12c7b118e8eda5057572c1ba05cd9b635edf33dabca4cac7291e0848f19c20e5beb850c3818f3543d49b3a5c729cb86a28fda539775d04feda112fe0c81d138aaf623aea7d507a4e826e890105db6065a44aba76a10d771c00d1b33f4ac51869806aae18eada68f19047024542d64a7aa1c91a5e1aa49d93613b5224b415bcc7aa166e4b55033438d20c641f9664fdb1689b53208181463e3d1325d46b30f07c5945b7e3fa1418bf833d975258461b294664eaf60795964924a280729c10a37fc6e967440bdd55d4ca53596286383481291152365303d44517cef369c00933b0b30368a230353e729c031075e8388673678a56b3ba84a165b28096ee9bd684483e1844258b451c365c41fa534152a3b64120041450128e960c7d6437d717ee266bdde7aaeec225ed93b958d188e97407349f1382976ca47d761ecc59a6f394487eb015c083abb490584677240eb47f838c838568a496119378b8bb81484610a50792b5d9c9939db188e7d0249d3cb918c436f111a2898849b286b0743a22c57464c709c5eaceac1ba493adca3328c0b14b5e38d3aea74e328b622b17e7181c35ad11c2103bdb7f2b209d93dcbc4ab61a06bc37139e6d2b7a06c5b7e9267bef3a8918a706f793271a5acc2574532da79e5a10cf074b998147a3c43586a411a513bba0d11cc19a36c83b19277f28022c88b120abfdba7076a8263e05336e3245aef7033eb3c762b5bbfa5791ac960398b649d5cbb652ddc6b2398143a0861ab3b410b696328879c099098adf819fbf7ac170030e86675e7f45c22ac9e1cf52c3102487bb0b91ab592afdc69c6e3a9b71876b86260b6c736b8291098f1130d3b763525cbad540ce2d042eacb6ed43b7bcba898f712c412f26066e09945f44ec7026c8ef959831abc10719d2017a12a41728b41c02371a5f5756ebc79406be708ea41bbd21563c874a0b791a3b4e4224a609967004f065c5ab4f3b4c61cb35df70573269da53179c3701fc5205f61974426f9b794c1b5826494b70842b6920c17752029369264dc8590b898b85c9d89a258e1f46c1b0490efd17c485cb51687cea272041e90b8e629521d3c5e3fa7518161bad7a159295b63cc6c0077897b53d47db8bc0ecb820f550705b65715a1a1094d04854f56acd26aa0baa10cb8447fad6211f53105796a42882328e6852e8de821c283b51eaab9bc95c4dc53615626049d63b1f9a457193805276b1905b0ab39353b5cf91fdd6023d4d816aef9cce4a3cfb3d12190172df221ae61d427563a098cc60e3dc9997ef54959180be5dc64a911157db6be3a01be2ee343caab33b8729abf0c50c674758c511291941fceac646232920907c2e88b9ec10211161729c797643a553a6ae5c4b7483c04e3263bd291e311c609071348b7c3310aa97d6b8318e0a4afe8399fa22f951049a9bb8860f7c69a333d3cc1aaf0129ab560713bf29eb3a01f9a276c78e54e3a3648b2447c80242b271b11406866389426d8b59796540d6b5702092ab21ee217c075cfc0c17ef826ce9ea29b9e61617457a5b1aaa23a58615dc53c59183beb36ea19498c21820b70ab47adeb678f1c52bf8768b3597b608ea1a8a15cd62e8a29bec4a1ac248ef9f02de0144bca06025f95a42bd6c8eaaaaaa2366328561d";
/**
 * Check if a byte array matches the test seed key.
 * Logs a warning if it does.
 */
export declare function warnIfTestSeed(seed: Uint8Array): boolean;
/**
 * Check if a byte array matches the test public key.
 * Logs a warning if it does.
 */
export declare function warnIfTestPubKey(pubKeyBytes: Uint8Array): boolean;
/**
 * X-Wing keypair interface.
 * X-Wing is a post-quantum hybrid KEM combining ML-KEM-768 and X25519.
 * - Private key: 32-byte seed
 * - Public key: 1216 bytes
 * - Encapsulated key: 1120 bytes
 */
export interface XwingKeypair extends PubKeyEncodable {
    scheme: XwingScheme;
    publicKey: CryptoKey;
    privateKey: CryptoKey;
}
/**
 * Derive X-Wing keypair from a 32-byte seed (deterministic).
 * This matches the Go implementation in covalidator/encoding/xwing.go
 *
 * @param seed - 32-byte seed for deterministic key derivation
 * @returns X-Wing keypair with cached public key bytes
 */
export declare function deriveXwingKeypairFromSeed(seed: Uint8Array): Promise<XwingKeypair>;
/**
 * Generate a random X-Wing keypair.
 *
 * @returns X-Wing keypair with cached public key bytes
 */
export declare function generateXwingKeypair(): Promise<XwingKeypair>;
/**
 * Decode X-Wing public key from bytes.
 *
 * @param pubKeyBytes - 1216-byte X-Wing public key
 * @returns CryptoKey for encryption operations
 */
export declare function decodeXwingPublicKey(pubKeyBytes: Uint8Array): Promise<CryptoKey>;
/**
 * Decode X-Wing private key from 32-byte seed.
 * Alias for deriveXwingKeypairFromSeed for consistency with Go API.
 *
 * @param seed - 32-byte seed
 * @returns X-Wing keypair
 */
export declare function decodeXwingPrivateKey(seed: Uint8Array): Promise<XwingKeypair>;
/**
 * Encode X-Wing public key to bytes.
 *
 * @param publicKey - CryptoKey containing X-Wing public key
 * @returns 1216-byte serialized public key
 */
export declare function encodeXwingPublicKey(publicKey: CryptoKey): Promise<Uint8Array>;
/**
 * X-Wing encryptor arguments.
 * pubKeyA is the recipient's public key (usually the covalidator's public key).
 */
export type XwingEncryptorArgs = {
    pubKeyA: CryptoKey;
};
/**
 * X-Wing decryptor arguments.
 * privKeyA is the recipient's private key (usually the covalidator's private key).
 */
export type XwingDecryptorArgs = {
    privKeyA: XwingKeypair;
};
/**
 * Encrypt using X-Wing HPKE (RFC 9180) with ChaCha20-Poly1305 AEAD.
 *
 * Output format: encappedKey (1120 bytes) || ciphertext (variable length)
 *
 * @param pubKeyA - Recipient's public key
 * @param msg - Message to encrypt
 * @param aad - Additional authenticated data (default: empty)
 * @param info - Context info for key derivation (default: empty)
 * @returns Encrypted data (encappedKey || ciphertext)
 */
export declare function encrypt(pubKeyA: CryptoKey, msg: Uint8Array, aad?: Uint8Array, info?: Uint8Array): Promise<Uint8Array>;
/**
 * Decrypt using X-Wing HPKE (RFC 9180) with ChaCha20-Poly1305 AEAD.
 *
 * Input format: encappedKey (1120 bytes) || ciphertext (variable length)
 *
 * @param privKeyA - Recipient's private key
 * @param encryptedData - Encrypted data (encappedKey || ciphertext)
 * @param aad - Additional authenticated data (default: empty)
 * @param info - Context info for key derivation (default: empty)
 * @returns Decrypted plaintext
 */
export declare function decrypt(privKeyA: XwingKeypair, encryptedData: Uint8Array, aad?: Uint8Array, info?: Uint8Array): Promise<Uint8Array>;
/**
 * Create an X-Wing encryptor for encrypting inputs.
 * Follows the same pattern as ECIES encryptor in ecies.ts.
 *
 * The encryptor:
 * 1. Encodes the plaintext with its context (HADU encoding)
 * 2. Encrypts using X-Wing HPKE
 * 3. Computes handle for tracking
 * 4. Returns the encrypted ciphertext with metadata
 *
 * @param args - X-Wing encryptor arguments (recipient's public key)
 * @returns Encryptor function
 */
export declare function getXwingEncryptor({ pubKeyA, }: XwingEncryptorArgs): Encryptor<XwingScheme>;
/**
 * Create an X-Wing decryptor for decrypting inputs.
 * Follows the same pattern as ECIES decryptor in ecies.ts.
 *
 * The decryptor:
 * 1. Removes the prepended handle from the ciphertext
 * 2. Decrypts using X-Wing HPKE
 * 3. Decodes the HADU-encoded payload
 * 4. Extracts and returns the plaintext
 *
 * @param args - X-Wing decryptor arguments (recipient's private key)
 * @returns Decryptor function
 */
export declare function getXwingDecryptor({ privKeyA, }: XwingDecryptorArgs): Decryptor<XwingScheme>;
/**
 * Returns true if the raw public key bytes match the public key encoded by the keypair.
 * Used to catch caller mistakes before sending the keypair to the covalidator, where a
 * mismatch would produce a cryptic signature error instead of a clear failure.
 */
export declare function reencryptPublicKeysMatch(reencryptPubKey: Uint8Array, reencryptKeypair: XwingKeypair): boolean;