/**
 * Cryptographic agility layer — abstract interfaces for all crypto operations.
 *
 * The protocol depends on properties (signing, encryption, hashing) not
 * specific algorithms. Like TLS cipher suites — the protocol works regardless
 * of which suite is negotiated.
 *
 * Default provider uses Ed25519 / X25519 / NaCl secretbox / SHA-256.
 * Operators can swap in post-quantum algorithms by providing a custom provider.
 */
/** A signing key pair (e.g. Ed25519, Dilithium). */
export interface SignKeyPair {
    publicKey: Uint8Array;
    secretKey: Uint8Array;
}
/** A key-exchange key pair (e.g. X25519, Kyber). */
export interface BoxKeyPair {
    publicKey: Uint8Array;
    secretKey: Uint8Array;
}
/** Digital signature operations. */
export interface SigningProvider {
    /** Algorithm identifier (e.g. "ed25519", "dilithium3"). */
    readonly algorithmId: string;
    /** Multicodec prefix for DID encoding. Ed25519 = [0xed, 0x01]. */
    readonly multicodecPrefix: Uint8Array;
    /** Generate a new signing key pair. */
    generateKeyPair(): SignKeyPair;
    /** Produce a detached signature. */
    sign(message: Uint8Array, secretKey: Uint8Array): Uint8Array;
    /** Verify a detached signature. */
    verify(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): boolean;
}
/** Ephemeral key exchange (Diffie-Hellman or KEM). */
export interface KeyExchangeProvider {
    readonly algorithmId: string;
    /** Generate an ephemeral key pair for a single session. */
    generateKeyPair(): BoxKeyPair;
    /** Derive a shared secret from remote public key + local secret key. */
    deriveSharedKey(remotePublicKey: Uint8Array, localSecretKey: Uint8Array): Uint8Array;
}
/** Authenticated symmetric encryption. */
export interface SymmetricEncryptionProvider {
    readonly algorithmId: string;
    /** Required nonce length in bytes. */
    readonly nonceLength: number;
    /** Encrypt plaintext with nonce and key. Returns ciphertext with auth tag. */
    encrypt(plaintext: Uint8Array, nonce: Uint8Array, key: Uint8Array): Uint8Array;
    /** Decrypt ciphertext. Returns null if authentication fails (tampered). */
    decrypt(ciphertext: Uint8Array, nonce: Uint8Array, key: Uint8Array): Uint8Array | null;
}
/** Cryptographic hashing. */
export interface HashingProvider {
    readonly algorithmId: string;
    /** Hash a string, return hex digest. */
    hash(data: string): string;
    /**
     * HKDF key derivation (RFC 5869).
     *
     * `info` is REQUIRED and must be a domain-specific label unique to the
     * calling context (e.g. "soma-vault/v1", "soma-seed-nonce/v1"). Two
     * derivations with the same `ikm` but different `info` MUST produce
     * independent keys. This is the protection against cross-context key
     * reuse — omitting or reusing `info` defeats the entire purpose.
     *
     * `salt` is optional; when omitted, HKDF uses a zero-filled hash block
     * per RFC 5869 §2.2.
     */
    deriveKey(ikm: Uint8Array, length: number, info: string, salt?: Uint8Array): Uint8Array;
}
/** Binary ↔ string encoding. */
export interface EncodingProvider {
    encodeBase64(bytes: Uint8Array): string;
    decodeBase64(str: string): Uint8Array;
    encodeUTF8(bytes: Uint8Array): string;
    decodeUTF8(str: string): Uint8Array;
}
/** HMAC (keyed hash for message authentication). */
export interface HmacProvider {
    readonly algorithmId: string;
    /** Compute HMAC of message with key. Returns hex digest. */
    compute(key: Uint8Array, message: string): string;
    /** Verify HMAC. Constant-time comparison. */
    verify(key: Uint8Array, message: string, expectedHmac: string): boolean;
}
/** Cryptographically secure random bytes. */
export interface RandomProvider {
    randomBytes(length: number): Uint8Array;
}
/**
 * Complete cryptographic provider — all algorithms needed by the protocol.
 *
 * Pass a custom provider to swap algorithms without touching the protocol.
 * Every crypto-using function accepts an optional provider parameter;
 * if omitted, the global default provider is used.
 */
export interface CryptoProvider {
    readonly signing: SigningProvider;
    readonly keyExchange: KeyExchangeProvider;
    readonly encryption: SymmetricEncryptionProvider;
    readonly hashing: HashingProvider;
    readonly hmac: HmacProvider;
    readonly encoding: EncodingProvider;
    readonly random: RandomProvider;
}
/** The default provider: Ed25519 + X25519 + XSalsa20-Poly1305 + SHA-256 + HMAC-SHA256. */
export declare const DEFAULT_PROVIDER: CryptoProvider;
/** Get the current global crypto provider. */
export declare function getCryptoProvider(): CryptoProvider;
/** Set the global crypto provider (call once at startup). */
export declare function setCryptoProvider(provider: CryptoProvider): void;
/** Reset the global provider to the default NaCl/SHA-256 suite. */
export declare function resetCryptoProvider(): void;
//# sourceMappingURL=crypto-provider.d.ts.map