import { AccountId, ChainId } from 'caip';
import type { Address, BitcoinAddress, EvmAddress } from './types';
import { AddressVersion } from './config';
import { type VaultEncryptionKeyWithMetadata, type Secp256k1PrivateKeyBytes } from './cryptography';
import { LibQCStorage } from './storage';
import { AddressIndex, Asset, Entropy, Seed, type WithdrawalRecord } from './types';
/**
 * Storage keys for each independently-encrypted state segment.
 */
export declare const STATE_SEGMENT_KEYS: {
    readonly entropy: "state.entropy";
    readonly seed: "state.seed";
    readonly addresses: "state.addresses";
    readonly assets: "state.assets";
    readonly withdrawals: "state.withdrawals";
    readonly httpSigning: "state.httpSigning";
};
export type StateSegmentName = keyof typeof STATE_SEGMENT_KEYS;
/**
 * Returns the default empty LibQC state.
 */
export declare const getDefaultLibQCState: () => LibQCState;
/**
 * Persisted account derivation info.
 */
export interface PersistedAddress {
    chainType: 'evm' | 'bitcoin';
    address: EvmAddress | BitcoinAddress;
    index: AddressIndex;
    /** Binary private key (Uint8Array) */
    secp256k1PrivateKey: Secp256k1PrivateKeyBytes;
    /** Owner EOA address (only for EVM) */
    secp256k1PublicKeyHash?: EvmAddress;
    accounts: PersistedAccount[];
    chainData?: Array<{
        chainId: string | ChainId;
        address: string;
        secp256r1PublicKey?: Uint8Array;
    }>;
    version: AddressVersion;
}
/** EVM persisted address for backward compatibility */
export type EvmPersistedAddress = PersistedAddress & {
    chainType: 'evm';
    address: EvmAddress;
    secp256k1PublicKeyHash: EvmAddress;
};
/** Bitcoin persisted address for backward compatibility */
export type BitcoinPersistedAddress = PersistedAddress & {
    chainType: 'bitcoin';
    address: BitcoinAddress;
};
export type PersistedAccount = {
    id: AccountId;
    address: Address;
    chainId: ChainId;
};
/**
 * Encrypted vault segment: ML-DSA-65 credentials for signed JSON-RPC HTTP.
 */
export interface PersistedHttpSigningCredentials {
    readonly keyId: string;
    /** ML-DSA-65 secret key (raw). */
    mlDsa65SecretKey: Uint8Array;
}
export type LibQCState = {
    entropy?: Entropy;
    seed?: Seed;
    addresses: PersistedAddress[];
    assets?: Asset[];
    httpSigning?: PersistedHttpSigningCredentials;
    withdrawals?: WithdrawalRecord[];
};
/**
 * Physically zeroes out all sensitive data in a LibQCState object or any object
 * following the wallet state structure (including raw intermediate objects).
 *
 * This includes the mnemonic, all secp256k1 private keys, and any sensitive
 * public key material. Use this in finally blocks to ensure sensitive data
 * does not linger in memory.
 *
 * @param state - The state object or raw data to zero out
 */
export declare function zeroLibQCState(state: unknown): void;
/**
 * Type guard for EvmPersistedAddress.
 */
export declare function isEvmPersistedAddress(addr: PersistedAddress): addr is EvmPersistedAddress;
/**
 * Staging keys used during two-phase key rotation.
 * Written before the main segment keys are overwritten.
 */
export declare const ROTATION_STAGING_KEYS: {
    readonly entropy: "state.entropy.next";
    readonly seed: "state.seed.next";
    readonly addresses: "state.addresses.next";
    readonly assets: "state.assets.next";
    readonly withdrawals: "state.withdrawals.next";
    readonly httpSigning: "state.httpSigning.next";
};
/**
 * Presence of this key signals that staging writes are complete and the
 * rotation should be committed (or re-committed on resume after a crash).
 */
export declare const ROTATION_MARKER_KEY = "state.rotation.pending";
/**
 * Reads a single encrypted state segment. Only decrypts the requested segment.
 * Unrelated segments remain encrypted in storage.
 *
 * @param storage - The storage implementation to retrieve state from
 * @param encryptionKey - The AES-256-GCM key with metadata
 * @param segment - The segment to read
 * @returns The decrypted segment value, or the segment default if absent
 */
export declare function getStateSegment<K extends StateSegmentName>(storage: LibQCStorage, encryptionKey: VaultEncryptionKeyWithMetadata, segment: K): Promise<LibQCState[K]>;
/**
 * Writes a single encrypted state segment. Only re-encrypts the affected segment.
 * Unrelated segments remain untouched in storage.
 *
 * @param storage - The storage implementation to save state to
 * @param encryptionKey - The AES-256-GCM key with metadata
 * @param segment - The segment to write
 * @param value - The value to store for this segment
 */
export declare function setStateSegment<K extends StateSegmentName>(storage: LibQCStorage, encryptionKey: VaultEncryptionKeyWithMetadata, segment: K, value: LibQCState[K]): Promise<void>;
/**
 * Re-encrypts all segments with a new key using a two-phase commit.
 *
 * @param storage - The storage implementation
 * @param oldKey - The current AES-256-GCM key
 * @param newKey - The new AES-256-GCM key to rotate to
 */
export declare function rotateEncryptionKey(storage: LibQCStorage, oldKey: VaultEncryptionKeyWithMetadata, newKey: VaultEncryptionKeyWithMetadata): Promise<void>;
/**
 * Checks for an interrupted key rotation and completes it if found.
 *
 * @param storage - The storage implementation to check
 */
export declare function resumeRotationIfInterrupted(storage: LibQCStorage): Promise<void>;
/**
 * Returns true if the core segment keys are present in storage.
 *
 * The 'withdrawals' segment (ENG-1791) is intentionally excluded from this
 * check: it is created lazily on the first emptyVault call, so vaults that
 * predate the lifecycle feature must continue to be detected as encrypted.
 *
 * @param storage - The storage implementation to check
 * @returns True if all core segment keys are present
 */
export declare function hasEncryptedVault(storage: LibQCStorage): Promise<boolean>;
/**
 * Assembles full LibQC state from all encrypted segment keys.
 *
 * @param storage - The storage implementation to retrieve state from
 * @param encryptionKey - The AES-256-GCM key with metadata
 * @returns The full decrypted LibQC state
 */
export declare function getLibQCState(storage: LibQCStorage, encryptionKey: VaultEncryptionKeyWithMetadata): Promise<LibQCState>;
/**
 * Persists the complete LibQC state by writing all segments.
 *
 * @param storage - The storage implementation to save state to
 * @param state - The complete LibQC state to persist
 * @param encryptionKey - The AES-256-GCM key with metadata to encrypt the vault
 */
export declare function setLibQCState(storage: LibQCStorage, state: LibQCState, encryptionKey: VaultEncryptionKeyWithMetadata): Promise<void>;