import { isInitialized } from '../init.js';
import type { WasmSource } from '../wasm-source.js';
import type { MlDsaKeyPair } from './types.js';
import { MlDsaParams, MLDSA44, MLDSA65, MLDSA87 } from './params.js';
import { type PreHashAlgorithm } from './hashvariant.js';
export declare function mldsaInit(source: WasmSource): Promise<void>;
export type { WasmSource };
export type { MlDsaKeyPair, MlDsaExports, Sha3Exports } from './types.js';
export { MLDSA44, MLDSA65, MLDSA87 };
export type { MlDsaParams };
export type { PreHashAlgorithm } from './hashvariant.js';
export { isInitialized };
export declare class MlDsaBase {
    readonly params: MlDsaParams;
    constructor(params: MlDsaParams);
    private get mx();
    private get sx();
    private get sha2x();
    /**
     * Deterministic key generation, FIPS 204 §6.1 Algorithm 6.
     * @param xi 32-byte seed. The sole input; ml-dsa keygen has no
     *           additional rejection-tied randomness.
     */
    keygenDerand(xi: Uint8Array): MlDsaKeyPair;
    /** Random key generation, wraps `keygenDerand` with `randomBytes(32)`. */
    keygen(): MlDsaKeyPair;
    /**
     * Hedged signing, FIPS 204 §3.4 (recommended default).
     * Generates a fresh 32-byte rnd via `randomBytes()` per signature; the
     * rnd is mixed into ρ'' so two signatures over the same (sk, M) produce
     * different bytes. Hedged signatures are recommended over deterministic
     * because they remain unforgeable under fault attacks that bias the
     * rejection-sampling stream (FIPS 204 §3.4 / §3.6.1).
     */
    sign(sk: Uint8Array, M: Uint8Array, ctx?: Uint8Array): Uint8Array;
    /**
     * Deterministic signing, FIPS 204 §3.4. Sets rnd ← 0³² so two
     * signatures over the same (sk, M) produce identical bytes. Caller
     * accepts the §3.4 caveat: deterministic signatures are vulnerable to
     * fault attacks that bias the SampleInBall stream, use only when no
     * entropy is available or determinism is a hard protocol requirement.
     */
    signDeterministic(sk: Uint8Array, M: Uint8Array, ctx?: Uint8Array): Uint8Array;
    /**
     * Externally-randomised signing, testing / CAVP API. Caller supplies
     * the 32-byte rnd; library does not mix in additional entropy. Hard
     * contract on the caller: rnd MUST come from an approved RBG and MUST
     * NOT be reused across signatures. ACVP `sigGen` test vectors (with a
     * supplied rnd) drive this path.
     */
    signDerand(sk: Uint8Array, M: Uint8Array, ctx: Uint8Array, rnd: Uint8Array): Uint8Array;
    /**
     * Pure ML-DSA verify, FIPS 204 §5.3 Algorithm 3 / §6.3 Algorithm 8.
     *
     * Returns boolean, `true` only if (a) the FIPS 204 norm bound on z
     * holds and (b) the constant-time comparison of c̃ to the recomputed
     * c̃' succeeds. Throws RangeError only on caller-side contract
     * violations (`ctx.length > 255`). Wrong-length pk/sig and malformed
     * hint encodings are NOT contract violations: they cause `verify` to
     * return false (FIPS 204 §3.6.2 / §D.3).
     */
    verify(vk: Uint8Array, M: Uint8Array, sig: Uint8Array, ctx?: Uint8Array): boolean;
    private _assertHashPrereqs;
    /**
     * Hedged HashML-DSA sign, FIPS 204 §5.4 Algorithm 4.
     *
     * Pre-hashes `M` with the chosen approved function `ph`, builds
     * M' = 0x01 ‖ |ctx| ‖ ctx ‖ OID(ph) ‖ PH_M, then drives
     * ML-DSA.Sign_internal with a fresh 32-byte rnd (FIPS 204 §3.4
     * recommended default; see {@link sign} for the rationale).
     */
    signHash(sk: Uint8Array, M: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
    /**
     * Deterministic HashML-DSA sign, FIPS 204 §5.4 Algorithm 4 with
     * rnd ← 0³². Same fault-attack caveat as {@link signDeterministic}.
     */
    signHashDeterministic(sk: Uint8Array, M: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
    /**
     * Externally-randomised HashML-DSA sign, testing / CAVP API. Caller
     * supplies the 32-byte rnd (same contract as {@link signDerand}). Used
     * to oracle ACVP HashML-DSA sigGen vectors with byte-identical output.
     */
    signHashDerand(sk: Uint8Array, M: Uint8Array, ph: PreHashAlgorithm, ctx: Uint8Array, rnd: Uint8Array): Uint8Array;
    /**
     * HashML-DSA verify, FIPS 204 §5.4 Algorithm 5.
     *
     * Same return / throw posture as {@link verify}: returns boolean for
     * every signature outcome (including malformed-σ → false), throws
     * RangeError only on caller-side contract violations such as
     * `ctx.length > 255` or unsupported `ph`.
     */
    verifyHash(vk: Uint8Array, M: Uint8Array, sig: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): boolean;
    /**
     * Hedged HashML-DSA sign with a caller-supplied prehash, FIPS 204
     * §5.4 Algorithm 4 lines 22-24 (the post-PH path).
     *
     * `digest` must be exactly `digestSize(ph)` bytes (FIPS 204 §5.4.1);
     * a mismatch throws `SigningError('sig-malformed-input')`. The caller
     * owns `digest` and is responsible for wiping it; this method never
     * mutates the buffer.
     *
     * Hedged variant generates a fresh 32-byte rnd internally per
     * signature, see {@link sign} for the §3.4 rationale.
     */
    signHashPrehashed(sk: Uint8Array, digest: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
    /**
     * Deterministic HashML-DSA sign with a caller-supplied prehash, rnd
     * ← 0³² per FIPS 204 §3.4. Same fault-attack caveat as
     * {@link signDeterministic}.
     */
    signHashPrehashedDeterministic(sk: Uint8Array, digest: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
    /**
     * Externally-randomised HashML-DSA sign with a caller-supplied
     * prehash, testing / CAVP API. Caller supplies the 32-byte rnd (same
     * contract as {@link signDerand}): rnd MUST come from an approved RBG
     * and MUST NOT be reused across signatures.
     */
    signHashPrehashedDerand(sk: Uint8Array, digest: Uint8Array, ph: PreHashAlgorithm, rnd: Uint8Array, ctx?: Uint8Array): Uint8Array;
    /**
     * HashML-DSA verify with a caller-supplied prehash, FIPS 204 §5.4
     * Algorithm 5 lines 17-19 (the post-PH path).
     *
     * Returns boolean for every signature outcome. Wrong-length pk / σ
     * and wrong-size `digest` all return `false` (FIPS 204 §3.6.2
     * structural mismatch). Throws `RangeError` only on caller-side
     * contract violations (`ctx.length > 255`, unsupported `ph`).
     */
    verifyHashPrehashed(vk: Uint8Array, digest: Uint8Array, sig: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): boolean;
    dispose(): void;
}
/** ML-DSA-44, FIPS 204 §4 Table 1 (NIST security category 2). */
export declare class MlDsa44 extends MlDsaBase {
    constructor();
}
/** ML-DSA-65, FIPS 204 §4 Table 1 (NIST security category 3). */
export declare class MlDsa65 extends MlDsaBase {
    constructor();
}
/** ML-DSA-87, FIPS 204 §4 Table 1 (NIST security category 5). */
export declare class MlDsa87 extends MlDsaBase {
    constructor();
}