import { isInitialized } from '../init.js';
import type { WasmSource } from '../wasm-source.js';
import type { Ed25519KeyPair } from './types.js';
/**
 * Initialise the curve25519 WASM module under the `ed25519` alias.
 * Equivalent to `x25519Init(source)`; both target the same WASM module
 * and the init layer de-dupes when given identical sources.
 */
export declare function ed25519Init(source: WasmSource): Promise<void>;
export type { WasmSource };
export type { Ed25519KeyPair, Ed25519Exports } from './types.js';
export { isInitialized };
export declare class Ed25519 {
    constructor();
    private get mx();
    /**
     * Deterministic Ed25519 key generation, RFC 8032 §5.1.5.
     * @param seed 32-byte secret seed
     * @returns 32-byte verifying key and a fresh 32-byte secret-key copy
     *          of the supplied seed (the spec defines sk = seed).
     */
    keygenDerand(seed: Uint8Array): Ed25519KeyPair;
    /** Random Ed25519 key generation, wraps `keygenDerand` with `randomBytes(32)`. */
    keygen(): Ed25519KeyPair;
    /**
     * Pure Ed25519 sign, RFC 8032 §5.1.6.
     *
     * The WASM re-derives pk from `sk` internally and compares it against
     * the caller-supplied `pk`; a mismatch traps via `unreachable` and is
     * rethrown as `SigningError('sig-ed25519-pk-mismatch')`. This defends
     * against fault injection that bias the per-signature randomness
     * derivation by forcing the caller to also know pk.
     */
    sign(sk: Uint8Array, pk: Uint8Array, M: Uint8Array): Uint8Array;
    /**
     * Ed25519ph sign, RFC 8032 §5.1.7 (prehash, dom2 phflag=1).
     *
     * Caller supplies the 64-byte SHA-512(M) digest; the library does not
     * compute it. Same pk-mismatch fault-injection trap as `sign`.
     */
    signPrehashed(sk: Uint8Array, pk: Uint8Array, digest: Uint8Array, ctx: Uint8Array): Uint8Array;
    /**
     * Suite-only: pure Ed25519 sign that derives pk internally and
     * skips the fault-injection cross-check. See AGENTS.md
     * "SignatureSuite lifecycle". Underscore-prefixed, not part of
     * the public API.
     */
    _signInternalPk(sk: Uint8Array, M: Uint8Array): Uint8Array;
    /**
     * Suite-only: Ed25519ph mirror of `_signInternalPk`. See
     * AGENTS.md "SignatureSuite lifecycle".
     */
    _signPrehashedInternalPk(sk: Uint8Array, digest: Uint8Array, ctx: Uint8Array): Uint8Array;
    /**
     * Strict pure Ed25519 verify, RFC 8032 §5.1.7 / FIPS 186-5 §7.6.4.
     *
     * Returns `true` on success, `false` on every signature failure mode:
     * off-curve pk, non-canonical R, non-canonical S (>= L), small-order
     * pk, or signature equation inequality. Throws only on caller-side
     * contract violations (wrong-length pk / M / sig).
     */
    verify(pk: Uint8Array, M: Uint8Array, sig: Uint8Array): boolean;
    /**
     * Strict Ed25519ph verify, RFC 8032 §5.1.7 prehash. Same rejection
     * conditions as {@link verify} plus the dom2(F=1, ctx) prefix on the
     * per-spec SHA-512 inputs (handled inside the WASM).
     */
    verifyPrehashed(pk: Uint8Array, digest: Uint8Array, ctx: Uint8Array, sig: Uint8Array): boolean;
    dispose(): void;
}