/**
 * SRP (Secure Remote Password) Client Library
 *
 * This implementation uses WebCrypto API for cryptographic operations and matches
 * the server-side Go implementation for compatibility.
 *
 * @mitigation Information Disclosure: Passwords are never transmitted to the server.
 * @mitigation Tampering: Cryptographic proofs ensure both parties have the correct password.
 */
import { SRPConfig, RegistrationResult, AuthenticationResult } from './types';
/**
 * SRP Client for registration and authentication.
 *
 * Example usage:
 * ```typescript
 * const client = new SRPClient({
 *   group: 3,
 *   baseURL: 'https://api.example.com'
 * });
 *
 * // Registration
 * const regResult = await client.register('user@example.com', 'password123');
 *
 * // Authentication
 * const authResult = await client.authenticate('user@example.com', 'password123');
 * ```
 */
export declare class SRPClient {
    private config;
    constructor(config: SRPConfig);
    /**
     * Register a new user with SRP.
     *
     * This computes the verifier client-side and sends it to the server along with the salt.
     * The server stores the verifier but never sees the password.
     *
     * @param identifier - User identifier (e.g., email)
     * @param password - User's password
     * @returns Registration result
     *
     * @mitigation Information Disclosure: Password never leaves the client.
     * @mitigation Spoofing: Verifier cannot be used to recover the password.
     */
    register(identifier: string, password: string): Promise<RegistrationResult>;
    /**
     * Authenticate a user with SRP.
     *
     * This performs the SRP authentication protocol:
     * 1. Request salt and server's public ephemeral value (B)
     * 2. Compute client's public ephemeral value (A) and proof (M1)
     * 3. Send A and M1 to server
     * 4. Verify server's proof (M2)
     * 5. Derive session key (K)
     *
     * @param identifier - User identifier
     * @param password - User's password
     * @returns Authentication result with session key
     *
     * @mitigation Tampering: Protocol ensures both parties have the correct password.
     * @mitigation Information Disclosure: Session key is derived, not transmitted.
     */
    authenticate(identifier: string, password: string): Promise<AuthenticationResult>;
    /**
     * Compute x = H(salt | H(identifier | ":" | password))
     *
     * This is the private key derivation from the password.
     */
    private computeX;
    /**
     * Compute u = H(A | B)
     */
    private computeU;
    /**
     * Compute M1 = H(A | B | K)
     * Client's proof of session key possession.
     */
    private computeM1;
    /**
     * Compute M2 = H(A | M1 | K)
     * Server's proof of session key possession.
     */
    private computeM2;
    /**
     * SHA-256 hash function using WebCrypto.
     */
    private hashSHA256;
    /**
     * Modular exponentiation: base^exp mod modulus
     *
     * Uses JavaScript's native BigInt which handles large numbers efficiently.
     */
    private modPow;
    /**
     * Constant-time comparison to prevent timing attacks.
     *
     * @mitigation Information Disclosure: Prevents timing attacks that could leak password info.
     */
    private constantTimeCompare;
    /**
     * Convert bytes to Base64 (URL-safe).
     */
    private bytesToBase64;
    /**
     * Convert Base64 (URL-safe) to bytes.
     */
    private base64ToBytes;
    /**
     * HTTP POST helper.
     */
    private post;
}