import { type KeyPair, KeyType, type MlDsa65PublicKey, type PublicKey, type Signature, type SignedMessage, type SignMessageParams } from "../core/types.js";
/**
 * Ed25519 key pair implementation.
 *
 * @remarks
 * Implements the {@link KeyPair} interface used throughout the library and
 * provides NEP-413 message signing via {@link Ed25519KeyPair.signNep413Message}.
 */
export declare class Ed25519KeyPair implements KeyPair {
    publicKey: PublicKey;
    secretKey: string;
    private privateKey;
    constructor(secretKey: Uint8Array);
    sign(message: Uint8Array): Signature;
    /**
     * Sign a message according to NEP-413 specification
     *
     * NEP-413 enables off-chain message signing for authentication and ownership verification.
     * The message is signed with a full-access key but does not require gas or blockchain state.
     *
     * @param accountId - The NEAR account ID that owns this key
     * @param params - Message signing parameters (message, recipient, nonce)
     * @returns Signed message with account ID, public key, and base64-encoded signature
     *
     * @see https://github.com/near/NEPs/blob/master/neps/nep-0413.md
     *
     * @example
     * ```typescript
     * const nonce = crypto.getRandomValues(new Uint8Array(32))
     * const signedMessage = keyPair.signNep413Message("alice.near", {
     *   message: "Login to MyApp",
     *   recipient: "myapp.near",
     *   nonce,
     * })
     * console.log(signedMessage.signature) // Base64-encoded signature
     * ```
     */
    signNep413Message(accountId: string, params: SignMessageParams): SignedMessage;
    static fromRandom(): Ed25519KeyPair;
    static fromString(keyString: string): Ed25519KeyPair;
}
/**
 * Secp256k1 key pair implementation.
 *
 * NEAR expects secp256k1 public keys to be 64 bytes (uncompressed without 0x04 header).
 * The secp256k1 library returns 65-byte uncompressed keys (with 0x04 header), so we
 * manually remove/add that byte as needed.
 *
 * Secret keys are accepted either as the 32-byte scalar (nearcore / near-cli format)
 * or as 96 bytes `[private (32)][public (64)]`.
 *
 * Signatures are 65 bytes `[r (32)][s (32)][v (1)]`, computed directly over the
 * 32-byte digest passed to {@link Secp256k1KeyPair.sign} (no extra hashing), which
 * is what nearcore verifies.
 */
export declare class Secp256k1KeyPair implements KeyPair {
    publicKey: PublicKey;
    secretKey: string;
    private privateKey;
    constructor(secretKey: Uint8Array);
    /**
     * Sign a 32-byte digest (e.g. a transaction or delegate-action hash).
     *
     * The digest is signed as-is, matching nearcore's
     * `secp256k1::Message::from_slice(data)`; it is not hashed again.
     */
    sign(message: Uint8Array): Signature;
    /**
     * Sign a message according to NEP-413 specification
     *
     * NEP-413 enables off-chain message signing for authentication and ownership verification.
     * The message is signed with a full-access key but does not require gas or blockchain state.
     *
     * @param accountId - The NEAR account ID that owns this key
     * @param params - Message signing parameters (message, recipient, nonce)
     * @returns Signed message with account ID, public key, and base64-encoded signature
     *
     * @see https://github.com/near/NEPs/blob/master/neps/nep-0413.md
     *
     * @example
     * ```typescript
     * const nonce = crypto.getRandomValues(new Uint8Array(32))
     * const signedMessage = keyPair.signNep413Message("alice.near", {
     *   message: "Login to MyApp",
     *   recipient: "myapp.near",
     *   nonce,
     * })
     * console.log(signedMessage.signature) // Base64-encoded signature
     * ```
     */
    signNep413Message(accountId: string, params: SignMessageParams): SignedMessage;
    static fromRandom(): Secp256k1KeyPair;
    static fromString(keyString: string): Secp256k1KeyPair;
}
/**
 * ML-DSA-65 (FIPS 204) post-quantum key pair implementation.
 *
 * Keys are generated deterministically from a 32-byte seed via
 * {@link https://github.com/paulmillr/noble-post-quantum | @noble/post-quantum},
 * matching the FIPS 204 KeyGen used by nearcore. The 1952-byte public key is
 * what goes in `AddKey` actions and in a signed transaction's `public_key`.
 *
 * @remarks
 * The constructor accepts either form of ML-DSA-65 private-key material:
 * - a 32-byte seed (`ml-dsa-65:<seed>`), which is what this library serializes
 *   for a key it generated; the seed is expanded via `ml_dsa65.keygen(seed)`.
 * - the 4032-byte raw expanded secret key, which is what nearcore / near-cli
 *   `ml-dsa-65:` credentials store; the public key is derived with
 *   `ml_dsa65.getPublicKey(secretKey)` and the key is used directly (no keygen).
 *
 * `secretKey` round-trips whichever form it was constructed from: the 32-byte
 * seed stays `ml-dsa-65:<seed>`, the 4032-byte raw key stays
 * `ml-dsa-65:<raw key>`. Signatures are 3309 bytes.
 *
 * On-chain, an ML-DSA access key is stored as a 32-byte hash, so view RPCs
 * return an {@link MlDsa65PublicKeyHandle} (`ml-dsa-65-hash:`) that cannot be
 * turned back into a signing key.
 */
export declare class MlDsa65KeyPair implements KeyPair {
    publicKey: MlDsa65PublicKey;
    secretKey: string;
    private privateKey;
    /**
     * @param key - Either a 32-byte ML-DSA-65 seed or the 4032-byte raw expanded
     * secret key. Any other length throws {@link InvalidKeyError}.
     */
    constructor(key: Uint8Array);
    sign(message: Uint8Array): Signature;
    static fromRandom(): MlDsa65KeyPair;
    /**
     * Parse an `ml-dsa-65:<base58>` secret key string (a 32-byte seed or a
     * 4032-byte raw secret key).
     *
     * @throws {@link InvalidKeyError} if the string is a `ml-dsa-65-hash:` view
     * handle (a 32-byte hash, which cannot sign), is missing the `ml-dsa-65:`
     * prefix, or is not valid base58.
     */
    static fromString(keyString: string): MlDsa65KeyPair;
}
/**
 * Read-only handle for an on-trie ML-DSA-65 access key (`ml-dsa-65-hash:`).
 *
 * View RPCs (`view_access_key_list`) return ML-DSA keys as a 32-byte hash, not
 * the full 1952-byte public key. This handle round-trips for display and
 * equality but is NOT usable for signing or as an `AddKey` public key - the
 * full key is not recoverable from it.
 */
export interface MlDsa65PublicKeyHandle {
    keyType: KeyType.ML_DSA_65;
    /** The 32-byte on-trie hash. */
    hash: Uint8Array;
    toString(): string;
}
/**
 * Parse an `ml-dsa-65-hash:<base58-hash>` view handle into a read-only
 * {@link MlDsa65PublicKeyHandle}. The result cannot sign or be used in actions.
 */
export declare function parseMlDsa65Handle(handleString: string): MlDsa65PublicKeyHandle;
/**
 * Generate a new random Ed25519 key pair.
 * @returns A new {@link KeyPair} instance.
 */
export declare function generateKey(): KeyPair;
/**
 * Parse a key string to a {@link KeyPair}.
 *
 * @param keyString - Key string (e.g. `"ed25519:..."` or `"secp256k1:..."`).
 * @returns A concrete {@link Ed25519KeyPair} or {@link Secp256k1KeyPair}.
 */
export declare function parseKey(keyString: string): KeyPair;
/**
 * Parse a public key string to a {@link PublicKey} object.
 *
 * @param publicKeyString - Public key string (e.g. `"ed25519:..."` or `"secp256k1:..."`).
 * @returns {@link PublicKey} instance.
 */
export declare function parsePublicKey(publicKeyString: string): PublicKey;
/** Valid BIP-39 mnemonic lengths. */
export type SeedPhraseWordCount = 12 | 15 | 18 | 21 | 24;
/**
 * Options for {@link generateSeedPhrase}.
 */
export interface GenerateSeedPhraseOptions {
    /**
     * Number of words. Defaults to 12 for `"ed25519"` and 24 for
     * `"ml-dsa-65"`.
     */
    wordCount?: SeedPhraseWordCount;
    /**
     * Signature scheme the phrase will be used for. Defaults to `"ed25519"`.
     *
     * `"ml-dsa-65"` applies the NEP-649 rule for newly generated phrases: at
     * least 18 words.
     */
    keyType?: "ed25519" | "ml-dsa-65";
}
/**
 * Generate a BIP39 seed phrase using cryptographically secure randomness.
 *
 * Takes either a word count directly or a {@link GenerateSeedPhraseOptions}
 * object that also picks the signature scheme the phrase is generated for:
 *
 * - `"ed25519"` (the default) generates 12 words unless `wordCount` says
 *   otherwise; any of 12, 15, 18, 21, 24 is allowed.
 * - `"ml-dsa-65"` generates 24 words by default and requires at least 18, per
 *   {@link https://github.com/near/NEPs/pull/649 | NEP-649} - a 12-word phrase
 *   carries 128 bits of entropy, below ML-DSA-65's NIST Category 3 security
 *   level. A `wordCount` of 12 or 15 throws {@link InvalidKeyError}. (This is a
 *   rule for *generating* phrases; {@link parseSeedPhrase} still recovers a key
 *   from any valid 12-24 word phrase.)
 *
 * @param wordCountOrOptions - Number of words (12, 15, 18, 21, or 24), or a
 * {@link GenerateSeedPhraseOptions} object
 * @returns A BIP39 seed phrase string
 *
 * @example
 * ```typescript
 * generateSeedPhrase() // 12 words, for an ed25519 key
 * generateSeedPhrase(24) // 24 words
 * generateSeedPhrase({ keyType: "ml-dsa-65" }) // 24 words, NEP-649 compliant
 * ```
 */
export declare function generateSeedPhrase(wordCountOrOptions?: SeedPhraseWordCount | GenerateSeedPhraseOptions): string;
/**
 * Options for {@link parseSeedPhrase}.
 */
export interface ParseSeedPhraseOptions {
    /**
     * BIP-32 derivation path. Every segment must be hardened.
     * Defaults to `"m/44'/397'/0'"` (NEAR's coin type).
     */
    path?: string;
    /**
     * Signature scheme of the derived key. Defaults to `"ed25519"`.
     *
     * `"ml-dsa-65"` derives a post-quantum ML-DSA-65 (FIPS 204) key using the
     * SLIP-0010 construction from satoshilabs/slips#1968, standardized for NEAR
     * in {@link https://github.com/near/NEPs/pull/649 | NEP-649}: the master node
     * is `HMAC-SHA512(key = "ML-DSA-65 seed", data = BIP-39 seed)` and the
     * derived 32-byte node secret is the FIPS 204 seed ξ fed to ML-DSA key
     * generation.
     *
     * Recovery accepts any valid BIP-39 phrase of 12-24 words. The NEP-649
     * minimum of 18 words applies only to *generating* a new phrase - see
     * {@link generateSeedPhrase}.
     */
    keyType?: "ed25519" | "ml-dsa-65";
}
/**
 * Parse a BIP39 seed phrase to derive a key pair using SLIP-0010.
 *
 * For ed25519 this uses the 'ed25519 seed' HMAC key per SLIP-0010
 * specification, which is compatible with NEAR CLI and wallet-generated seed
 * phrases. For ML-DSA-65 it uses the 'ML-DSA-65 seed' HMAC key per
 * satoshilabs/slips#1968 and {@link https://github.com/near/NEPs/pull/649 |
 * NEP-649}, and the derived 32-byte node secret is the FIPS 204 seed ξ. The
 * same phrase yields unrelated ed25519 and ML-DSA-65 keys.
 *
 * Any valid BIP-39 phrase of 12-24 words is accepted for recovery, whatever the
 * key type. NEP-649's 18-word minimum applies only when generating a new phrase
 * for ML-DSA-65 - see {@link generateSeedPhrase}.
 *
 * @param phrase - BIP39 seed phrase (12-24 words)
 * @param pathOrOptions - Derivation path string (defaults to "m/44'/397'/0'"
 * for NEAR), or a {@link ParseSeedPhraseOptions} object to also pick the key
 * type
 * @returns KeyPair instance
 *
 * @example
 * ```typescript
 * const keyPair = parseSeedPhrase("word1 word2 ... word12")
 * console.log(keyPair.publicKey.toString()) // ed25519:...
 *
 * const pqKeyPair = parseSeedPhrase("word1 word2 ... word12", {
 *   keyType: "ml-dsa-65",
 * })
 * console.log(pqKeyPair.publicKey.toString()) // ml-dsa-65:...
 * ```
 */
export declare function parseSeedPhrase(phrase: string, pathOrOptions?: string | ParseSeedPhraseOptions): KeyPair;
//# sourceMappingURL=key.d.ts.map