export declare class NonceRangeError extends Error {
    constructor(message?: string);
}
export declare class InsecureHPoint extends Error {
    constructor(message?: string);
}
/** Sum of commitment points is the point at infinity (cannot be serialized). */
export declare class ResultAtInfinity extends Error {
    constructor(message?: string);
}
export interface PedersenCommitment {
    amount: bigint;
    /** 32-byte nonce scalar (may be zero for aggregate openings) */
    nonce: Uint8Array;
    /** Compressed (33-byte) commitment point */
    point: Uint8Array;
    /** Uncompressed (65-byte) commitment point */
    pointUncompressed: Uint8Array;
}
/**
 * Pedersen setup for commitments C = nonce*G + amount*H (same algebra as
 * Electrum ABC).
 *
 * Rejects insecure H with a known discrete log vs G:
 * - H = -G (HG at infinity), same as Electrum
 * - H = G (then C = (nonce+amount)G and binding is lost)
 *
 * Callers supply a nothing-up-my-sleeve H (Electrum/ALP fixed domain strings).
 * This API does not derive H itself.
 *
 * Implementation detail: we store H and H+G and evaluate the equivalent form
 *   C = (a - k)*H + k*(H + G)
 * so the amount scalar multiply is blinded by the nonce (see Electrum
 * `Commitment._calc_initial`). Expand to recover C = k*G + a*H.
 *
 * Fresh nonces from {@link commit} are in [1, n). A zero nonce is accepted when
 * supplied explicitly (e.g. aggregate openings where nonces cancel): then
 * C = amount*H. The (amount, nonce) = (0, 0) opening is the identity and cannot
 * be serialized as a point — use {@link verifyCommitmentSum} for that case.
 */
export declare class PedersenSetup {
    /** Compressed H */
    readonly H: Uint8Array;
    /** Compressed H+G */
    readonly HG: Uint8Array;
    constructor(H: Uint8Array);
    commit(amount: bigint, nonce?: Uint8Array): PedersenCommitment;
}
export declare function addCommitmentPoints(points: Uint8Array[]): Uint8Array;
/**
 * Verify that commitments open to (totalAmount, totalNonce).
 * Returns a boolean (does not throw for the identity aggregate): when the
 * points sum to infinity, the only valid opening is amount ≡ 0 and nonce = 0.
 * Ill-formed commitments or nonce always return false (never true).
 */
export declare function verifyCommitmentSum(setup: PedersenSetup, commitments: Uint8Array[], totalAmount: bigint, totalNonce: Uint8Array): boolean;
/**
 * Sum two 32-byte seckeys/nonces mod n (wasm seckeyAdd).
 * When (a + b) ≡ 0 (mod n), seckeyAdd throws — return canonical zero.
 */
export declare function addScalars(a: Uint8Array, b: Uint8Array): Uint8Array;
//# sourceMappingURL=pedersen.d.ts.map