import type { LemmaClient, SelectiveDisclosure } from "@lemmaoracle/spec";
export type BbsKeyPair = Readonly<{
    secretKey: Uint8Array;
    publicKey: Uint8Array;
}>;
export type SignInput = Readonly<{
    messages: ReadonlyArray<string>;
    secretKey: Uint8Array;
    header: Uint8Array;
    issuerId: string;
}>;
export type SignOutput = Readonly<{
    signature: Uint8Array;
    messages: ReadonlyArray<string>;
    publicKey: Uint8Array;
    header: Uint8Array;
    issuerId: string;
}>;
export type RevealInput = Readonly<{
    signature: Uint8Array;
    messages: ReadonlyArray<string>;
    publicKey: Uint8Array;
    indexes: ReadonlyArray<number>;
    header: Uint8Array;
}>;
export type RevealOutput = Readonly<{
    disclosed: Readonly<Record<string, unknown>>;
    proof: Uint8Array;
    indexes: ReadonlyArray<number>;
    messages: ReadonlyArray<string>;
}>;
export type VerifyProofInput = Readonly<{
    proof: Uint8Array;
    publicKey: Uint8Array;
    messages: ReadonlyArray<string>;
    indexes: ReadonlyArray<number>;
    count: number;
    header: Uint8Array;
}>;
/**
 * Ensure WASM is initialized before any crypto operations.
 * Safe to use multiple times - will only initialize once.
 */
export declare const ensureWasmInitialized: Promise<void>;
/**
 * Convert an attribute object `{ age: 25, name: "John" }` to a
 * deterministically-sorted array of `"key:value"` strings.
 */
export declare const payloadToMessages: (payload: Readonly<Record<string, unknown>>) => ReadonlyArray<string>;
/**
 * Reconstruct a disclosed-attribute map from the original messages and
 * the indexes that were revealed.
 */
export declare const messagesToDisclosedMap: (messages: ReadonlyArray<string>, indexes: ReadonlyArray<number>) => Readonly<Record<string, unknown>>;
export type KeyGenOptions = Readonly<{
    keyInfo?: Uint8Array;
}>;
/**
 * Generate a BBS+ key pair (secret key: 32 bytes, public key: 96 bytes).
 */
export declare const generateKeyPair: (options?: KeyGenOptions) => Promise<BbsKeyPair>;
/**
 * Issuer signs a set of attribute messages with their BBS+ secret key.
 *
 * Performs BBS+ signing via the `@docknetwork/crypto-wasm` WASM module,
 * which is lazy-initialized on first use (see `ensureWasmInitialized`).
 * This function performs no network I/O; it is a local cryptographic
 * operation against the WASM boundary. The `_client` parameter is
 * accepted for forward-compatibility of the public signature and is not
 * read; it is retained so future versions may add client-bound behavior
 * without a breaking change.
 *
 * Whitepaper §2.6 / §4.6.
 */
export declare const sign: (_client: LemmaClient, input: SignInput) => Promise<SignOutput>;
/**
 * Verify a BBS+ signature against the issuer's public key.
 *
 * Performs BBS+ verification via the `@docknetwork/crypto-wasm` WASM
 * module, which is lazy-initialized on first use (see
 * `ensureWasmInitialized`). This function performs no network I/O; it
 * is a local cryptographic operation against the WASM boundary. The
 * `_client` parameter is accepted for forward-compatibility of the
 * public signature and is not read; it is retained so future versions
 * may add client-bound behavior without a breaking change.
 *
 * Whitepaper §2.6 / §4.6.
 */
export declare const verify: (_client: LemmaClient, signOutput: SignOutput) => Promise<boolean>;
/**
 * Holder creates a selective disclosure proof, choosing which
 * attribute indexes to reveal.
 *
 * Performs BBS+ proof generation via the `@docknetwork/crypto-wasm`
 * WASM module, which is lazy-initialized on first use (see
 * `ensureWasmInitialized`). This function performs no network I/O; it
 * is a local cryptographic operation against the WASM boundary. The
 * `_client` parameter is accepted for forward-compatibility of the
 * public signature and is not read; its type is `LemmaClient | undefined`
 * intentionally — the high-level helper `createProof` calls
 * `reveal(undefined, ...)` since it has no client in scope. The
 * parameter is retained so future versions may add client-bound
 * behavior without a breaking change.
 *
 * Whitepaper §2.6 / §4.6.
 */
export declare const reveal: (_client: LemmaClient | undefined, input: RevealInput) => Promise<RevealOutput>;
/**
 * Verifier checks a selective-disclosure proof against the issuer's public key.
 *
 * Performs BBS+ proof verification via the `@docknetwork/crypto-wasm`
 * WASM module, which is lazy-initialized on first use (see
 * `ensureWasmInitialized`). This function performs no network I/O; it
 * is a local cryptographic operation against the WASM boundary. The
 * `_client` parameter is accepted for forward-compatibility of the
 * public signature and is not read; it is retained so future versions
 * may add client-bound behavior without a breaking change.
 *
 * Whitepaper §2.6 / §4.6.
 */
export declare const verifyProof: (_client: LemmaClient, input: VerifyProofInput) => Promise<boolean>;
/**
 * Context from the signing / reveal flow needed to make the
 * SelectiveDisclosure envelope self-verifiable.
 */
export type RevealContext = Readonly<{
    /** Issuer BLS12-381 public key (96 bytes). */
    publicKey: Uint8Array;
    /** Header bytes used during BBS+ signing. */
    header: Uint8Array;
    /** Total number of messages in the original BBS+ signature. */
    count: number;
    /** Optional access condition for the returned SelectiveDisclosure. */
    condition?: Readonly<{
        circuitId: string;
    }>;
}>;
/**
 * Wrap a RevealOutput into the spec's SelectiveDisclosure envelope.
 *
 * The RevealContext supplies the issuer public key, header, and total
 * message count so that any third-party verifier can later call
 * `disclose.verifyProof` using only the data inside the envelope.
 */
export declare const toSelectiveDisclosure: (output: RevealOutput, context: RevealContext) => SelectiveDisclosure;
/**
 * Reconstruct a VerifyProofInput from a persisted SelectiveDisclosure.
 *
 * This is the inverse of `toSelectiveDisclosure` — it converts the
 * hex-encoded envelope back into the binary form that `verifyProof`
 * expects, enabling any party to verify the BBS+ proof independently.
 */
export declare const fromSelectiveDisclosure: (sd: SelectiveDisclosure) => VerifyProofInput;
export type CreateProofInput = Readonly<{
    /** Attribute keys to reveal. Resolved to indexes against `signed.messages`
     *  by matching the `"key"` prefix of each `"key:value"` message. */
    attributes: ReadonlyArray<string>;
    /** Output of `sign` — supplies signature, messages, public key, and header. */
    signed: SignOutput;
}>;
/**
 * High-level selective-disclosure helper.
 *
 * Wraps `reveal` → `toSelectiveDisclosure` so callers can think in terms of
 * attribute key names instead of message arrays and indexes. Reuses
 * `signed.messages` to avoid recomputing `payloadToMessages`. Pair with
 * `fromSelectiveDisclosure` + `verifyProof` on the verifier side.
 */
export declare const createProof: (input: CreateProofInput) => Promise<SelectiveDisclosure>;
//# sourceMappingURL=disclose.d.ts.map