import { isInitialized } from '../init.js';
import type { WasmSource } from '../wasm-source.js';
import type { SlhDsaExports, SlhDsaKeyPair } from './types.js';
import { type SlhDsaParams, SLHDSA128F, SLHDSA192F, SLHDSA256F } from './params.js';
import { type PreHashAlgorithm } from './prehash.js';
export declare function slhdsaInit(source: WasmSource): Promise<void>;
export type { WasmSource };
export type { SlhDsaExports, SlhDsaKeyPair } from './types.js';
export { SLHDSA128F, SLHDSA192F, SLHDSA256F };
export type { SlhDsaParams };
export type { PreHashAlgorithm } from './prehash.js';
export { isInitialized };
/** Return the slhdsa WASM instance exports. Internal helper for tests that
 *  need raw access to the ADRS / hash / sponge primitives; consumers use
 *  the SlhDsa* classes below. */
export declare function getSlhDsaExports(): SlhDsaExports;
export declare class SlhDsaBase {
    readonly params: SlhDsaParams;
    constructor(params: SlhDsaParams);
    private get x();
    private get sx();
    private get sha2x();
    /**
     * Deterministic key generation, FIPS 205 §9.1 Algorithm 18.
     * @param seed 3n bytes laid out as `SK.seed ‖ SK.prf ‖ PK.seed`. Each
     *             component is `n` bytes (16 for 128f, 24 for 192f, 32 for
     *             256f). The slh_keygen_internal entry consumes this layout
     *             directly.
     */
    keygenDerand(seed: Uint8Array): SlhDsaKeyPair;
    /** Random key generation, wraps `keygenDerand` with `randomBytes(3n)`. */
    keygen(): SlhDsaKeyPair;
    /**
     * Hedged signing, FIPS 205 §3.4 / §10.2.1 Algorithm 22.
     * Generates a fresh n-byte addrnd (opt_rand) per signature; two
     * signatures over the same (sk, M, ctx) produce different bytes.
     * Hedged signing is recommended over deterministic because hedged
     * signatures remain unforgeable under fault attacks that bias the
     * rejection-sampling stream (FIPS 205 §3.4 / §9.2).
     */
    sign(sk: Uint8Array, M: Uint8Array, ctx?: Uint8Array): Uint8Array;
    /**
     * Deterministic signing, FIPS 205 §3.4. Sets opt_rand ← PK.seed so two
     * signatures over the same (sk, M, ctx) produce identical bytes.
     * Caller accepts the §3.4 caveat: deterministic signatures are
     * vulnerable to fault attacks that bias secret-derived intermediates;
     * use only when no entropy is available or determinism is a hard
     * protocol requirement. PK.seed lives at sk[2n..3n] inside the
     * `SK.seed ‖ SK.prf ‖ PK.seed ‖ PK.root` encoding (FIPS 205 §9.1).
     */
    signDeterministic(sk: Uint8Array, M: Uint8Array, ctx?: Uint8Array): Uint8Array;
    /**
     * Externally-randomised signing, testing / CAVP API. Caller supplies
     * the n-byte opt_rand; library does not mix in additional entropy.
     * Hard contract on the caller: opt_rand MUST come from an approved
     * RBG and MUST NOT be reused across signatures. ACVP SLH-DSA sigGen
     * vectors (with a supplied additionalRandomness) drive this path.
     */
    signDerand(sk: Uint8Array, M: Uint8Array, optRand: Uint8Array, ctx?: Uint8Array): Uint8Array;
    /**
     * Pure SLH-DSA verify, FIPS 205 §10.3 Algorithm 24 / §9.3 Algorithm 20.
     *
     * Returns boolean. Wrong-length pk / sig return false (FIPS 205 §3.6.2
     * structural mismatch; same posture as ML-DSA verify). Throws
     * `SigningError('sig-ctx-too-long')` only on the caller-side contract
     * violation `ctx.length > 255`.
     */
    verify(pk: Uint8Array, M: Uint8Array, sig: Uint8Array, ctx?: Uint8Array): boolean;
    private _assertHashPrereqs;
    /**
     * Hedged HashSLH-DSA sign, FIPS 205 §10.2.2 Algorithm 23.
     *
     * Pre-hashes `M` with the chosen approved function `ph`, builds
     * M' = 0x01 ‖ |ctx| ‖ ctx ‖ OID(ph) ‖ PH_M, then drives
     * slh_sign_internal with a fresh n-byte opt_rand (FIPS 205 §3.4
     * recommended default; see {@link sign} for the rationale).
     */
    signHash(sk: Uint8Array, M: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
    /**
     * Deterministic HashSLH-DSA sign, FIPS 205 §10.2.2 Algorithm 23 with
     * opt_rand ← PK.seed (the deterministic substitute per FIPS 205 §3.4).
     * Same fault-attack caveat as {@link signDeterministic}.
     */
    signHashDeterministic(sk: Uint8Array, M: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
    /**
     * Externally-randomised HashSLH-DSA sign, testing / CAVP API. Caller
     * supplies the n-byte opt_rand (same contract as {@link signDerand}).
     * Used to oracle ACVP HashSLH-DSA sigGen vectors with byte-identical
     * output.
     */
    signHashDerand(sk: Uint8Array, M: Uint8Array, ph: PreHashAlgorithm, optRand: Uint8Array, ctx?: Uint8Array): Uint8Array;
    /**
     * HashSLH-DSA verify, FIPS 205 §10.3 Algorithm 25.
     *
     * Same return / throw posture as {@link verify}: returns boolean for
     * every signature outcome (including malformed-σ → false), throws
     * `SigningError` only on caller-side contract violations
     * (`ctx.length > 255`) or `RangeError` on category violations and
     * unsupported `ph`.
     */
    verifyHash(pk: Uint8Array, M: Uint8Array, sig: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): boolean;
    /**
     * Hedged HashSLH-DSA sign with a caller-supplied prehash. FIPS 205
     * §10.2.2 Algorithm 23 lines 18-25 (the post-PH path).
     *
     * `digest` must be exactly `digestSize(ph)` bytes; a mismatch throws
     * `SigningError('sig-malformed-input')`. The caller owns `digest`
     * and is responsible for wiping it; this method never mutates the
     * buffer. Hedged variant generates a fresh n-byte opt_rand per call.
     */
    signHashPrehashed(sk: Uint8Array, digest: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
    /**
     * Deterministic HashSLH-DSA sign with a caller-supplied prehash,
     * opt_rand ← PK.seed per FIPS 205 §3.4. Same fault-attack caveat as
     * {@link signDeterministic}.
     */
    signHashPrehashedDeterministic(sk: Uint8Array, digest: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
    /**
     * Externally-randomised HashSLH-DSA sign with a caller-supplied
     * prehash, testing / CAVP API. Caller supplies the n-byte opt_rand:
     * MUST come from an approved RBG and MUST NOT be reused across
     * signatures.
     */
    signHashPrehashedDerand(sk: Uint8Array, digest: Uint8Array, ph: PreHashAlgorithm, optRand: Uint8Array, ctx?: Uint8Array): Uint8Array;
    /**
     * HashSLH-DSA verify with a caller-supplied prehash. FIPS 205 §10.3
     * Algorithm 25 lines 16-19 (the post-PH path).
     *
     * Returns boolean for every signature outcome. Wrong-length pk / σ
     * and wrong-size `digest` all return `false` (FIPS 205 §3.6.2 /
     * §10.3 structural mismatch). Throws on caller-side contract
     * violations only (`ctx.length > 255`, unsupported `ph`, category
     * mismatch).
     */
    verifyHashPrehashed(pk: Uint8Array, digest: Uint8Array, sig: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): boolean;
    dispose(): void;
}
/** SLH-DSA-SHAKE-128f, FIPS 205 §11.1 Table 2 (NIST security category 1). */
export declare class SlhDsa128f extends SlhDsaBase {
    constructor();
}
/** SLH-DSA-SHAKE-192f, FIPS 205 §11.1 Table 2 (NIST security category 3). */
export declare class SlhDsa192f extends SlhDsaBase {
    constructor();
}
/** SLH-DSA-SHAKE-256f, FIPS 205 §11.1 Table 2 (NIST security category 5). */
export declare class SlhDsa256f extends SlhDsaBase {
    constructor();
}