import type { MlDsaExports, Sha3Exports } from './types.js';
import type { MlDsaParams } from './params.js';
/**
 * ExpandA, FIPS 204 Algorithm 32.
 *
 * For (i, j) ∈ [0, k) × [0, ℓ):
 *   s ← ρ ‖ IntegerToBytes(j, 1) ‖ IntegerToBytes(i, 1)
 *   Â[i, j] ← RejNTTPoly(SHAKE128(s))
 *
 * Output is row-major: Â[i, j] sits at matrixOff + (i·ℓ + j) · 1024.
 * This matches `polyvec_matrix_pointwise_montgomery`'s row-stride contract.
 *
 * ρ is the public seed; the rej_ntt_poly inner loop has data-dependent
 * branching but only on ρ-derived bytes (public), so no CT concern.
 */
export declare function expandA(mx: MlDsaExports, sx: Sha3Exports, params: MlDsaParams, rho: Uint8Array, matrixOff: number): void;
/**
 * ExpandS, FIPS 204 Algorithm 33.
 *
 * For r ∈ [0, ℓ): s₁[r] ← RejBoundedPoly(SHAKE256(ρ' ‖ IntegerToBytes(r, 2)))
 * For r ∈ [0, k): s₂[r] ← RejBoundedPoly(SHAKE256(ρ' ‖ IntegerToBytes(r+ℓ, 2)))
 *
 * Note the index is 2 bytes (little-endian per FIPS 204 §7.1 Alg 11), mlkem
 * uses 1 byte because k ≤ 4, but ML-DSA's max index is k+ℓ-1 = 14 (still
 * ≤ 255 in practice but the spec mandates 2 bytes).
 *
 * ρ' is secret. The local seed scratch is wiped on exit; the caller is
 * responsible for the WASM-resident ρ' source buffer.
 */
export declare function expandS(mx: MlDsaExports, sx: Sha3Exports, params: MlDsaParams, rhoPrime: Uint8Array, s1Off: number, s2Off: number): void;
/**
 * ExpandMask, FIPS 204 Algorithm 34.
 *
 * For r ∈ [0, ℓ):
 *   v ← SHAKE256(ρ'' ‖ IntegerToBytes(κ + r, 2),  32·c)
 *   y[r] ← BitUnpack(v, γ₁ − 1, γ₁)
 *
 * where c = 1 + bitlen(γ₁ − 1) is the per-coefficient byte width
 * (18 when γ₁ = 2¹⁷, 20 when γ₁ = 2¹⁹). Output coefficients land in
 * [-(γ₁ − 1), γ₁]; bit_unpack(a=γ₁−1, b=γ₁) covers exactly that range.
 *
 * y is produced in time domain at `yPvOff`. Sign_internal applies
 * polyvec_ntt to y before the matrix-vector product  · NTT(y).
 *
 * ρ'' is secret (derived from K ‖ rnd ‖ μ). This function uses one
 * one-shot SHAKE256 per polynomial (caller's full input is ≤ 168 B,
 * fits in a single shake256HashConcat call); the SHAKE state is reset
 * each iteration via shake256Init inside the helper, so no state
 * carries between r values. The squeeze output lands in a TS-side
 * buffer and is set into the WASM XOF/PRF region only long enough for
 * bit_unpack to consume it.
 */
export declare function expandMask(mx: MlDsaExports, sx: Sha3Exports, params: MlDsaParams, rhoPrimePrime: Uint8Array, kappa: number, yPvOff: number): void;