import { type Address } from 'viem';
import type { DecryptionAttestation, EncryptedDecryptionAttestation } from '../attesteddecrypt/types.js';
import { type EListDecryptionAttestation, type EncryptedEListDecryptionAttestation } from '../elistattesteddecrypt/types.js';
import type { EncryptionScheme, SupportedTeeType } from '../encryption/encryption.js';
import type { AttestedComputeRequest, AttestedDecryptRequest, AttestedRevealRequest, EListAttestedDecryptRequest, EListAttestedRevealRequest } from '../generated/es/inco/kms/lite/v1/kms_service_pb.js';
import { type XwingKeypair } from '../lite/xwing.js';
import type { BackoffConfig } from '../retry.js';
import { type KmsClient } from './client.js';
import type { ViemClient } from '../viem.js';
export declare class KmsQuorumClient {
    private readonly kmss;
    private readonly threshold;
    private constructor();
    private constructor();
    /**
     * Creates a KmsQuorumClient from an array of URLs.
     * Requires signer addresses and threshold to be explicitly provided.
     *
     * @param urls - Array of KMS endpoint URLs
     * @param signers - Array of signer addresses, must match the length of URLs
     * @param threshold - Number of successful responses required (must be between 1 and urls.length)
     * @throws {Error} If URLs array is empty, signers length doesn't match URLs length, or threshold is invalid
     */
    static fromUrls(urls: string[], signers: Address[], threshold: number): KmsQuorumClient;
    /**
     * Creates a KmsQuorumClient from an array of KmsClient instances.
     * Each KmsClient must have a signerAddress property.
     *
     * @param kmsClients - Array of KMS client instances
     * @param threshold - Number of successful responses required (must be between 1 and kmsClients.length)
     * @throws {Error} If KMS clients array is empty or threshold is invalid
     */
    static fromKmsClients(kmsClients: KmsClient[], threshold: number): KmsQuorumClient;
    attestedDecrypt(request: AttestedDecryptRequest, executorAddress: Address, client: ViemClient, backoffConfig?: Partial<BackoffConfig>, reencryptKeypair?: XwingKeypair): Promise<(DecryptionAttestation<EncryptionScheme, SupportedTeeType> | EncryptedDecryptionAttestation<EncryptionScheme, SupportedTeeType>)[]>;
    attestedCompute(request: AttestedComputeRequest, executorAddress: Address, client: ViemClient, backoffConfig?: Partial<BackoffConfig>, reencryptKeypair?: XwingKeypair): Promise<DecryptionAttestation<EncryptionScheme, SupportedTeeType> | EncryptedDecryptionAttestation<EncryptionScheme, SupportedTeeType>>;
    attestedReveal(request: AttestedRevealRequest, executorAddress: Address, client: ViemClient, backoffConfig?: Partial<BackoffConfig>): Promise<(DecryptionAttestation<EncryptionScheme, SupportedTeeType> | EncryptedDecryptionAttestation<EncryptionScheme, SupportedTeeType>)[]>;
    eListAttestedDecrypt(request: EListAttestedDecryptRequest, executorAddress: Address, client: ViemClient, backoffConfig?: Partial<BackoffConfig>, reencryptKeypair?: XwingKeypair): Promise<EListDecryptionAttestation<EncryptionScheme, SupportedTeeType> | EncryptedEListDecryptionAttestation<EncryptionScheme, SupportedTeeType>>;
    eListAttestedReveal(request: EListAttestedRevealRequest, executorAddress: Address, client: ViemClient, backoffConfig?: Partial<BackoffConfig>): Promise<EListDecryptionAttestation<EncryptionScheme, SupportedTeeType>>;
    /**
     * Generic method to execute a KMS operation across all clients with retry and threshold logic.
     * Returns results with both the response and signer address.
     */
    private executeKmsOperationWithThreshold;
    /**
     * Collects signatures from responses and sorts them by signer address (ascending).
     * This is required by SignatureVerifier.
     */
    private collectAndSortSignatures;
    /**
     * Builds a plaintext attestation from a DecryptionAttestation proto message.
     */
    private buildPlaintextAttestation;
    private buildAggregatedAttestations;
    private buildAggregatedComputeAttestation;
    private buildAggregatedEListAttestation;
    /**
     * Verifies proof hashes at two levels:
     * 1. Aggregate: keccak256(concat(proofHashes)) must equal the attested commitmentProof
     * 2. Per-element:
     *    - For plaintext (reveal): proofHash[i] = keccak256(value[i])
     *    - For reencryption (decrypt): proofHash[i] = keccak256(commitment[i] || plaintext[i])
     *      — requires reencryptKeypair to decrypt the ciphertext first.
     */
    private verifyElementProofHashes;
}