/**
 * AuditTool — Decrypt ElGamal-encrypted audit records with selective disclosure.
 *
 * Per design doc §7.3:
 *   - Master key: decrypt ALL audit records across all providers
 *   - Provider-derived key: decrypt only records for that specific provider
 *   - Export provider key: give to a third-party auditor for scoped access
 *
 * ElGamal ciphertext format (64 bytes):
 *   C1 = r * G           (32 bytes, compressed Ristretto255 point)
 *   C2 = data XOR SHA256("subly402-elgamal-mask-v1" || r * P)  (32 bytes)
 *
 * Key derivation (HKDF-SHA256):
 *   provider_secret = HKDF(master_secret, salt="subly402-audit-v1", info=provider_address)
 *   provider_key = provider_secret mod l (reduced to Ristretto scalar)
 */
import { PublicKey, Connection } from "@solana/web3.js";
/** Decrypted audit record */
export interface DecryptedAuditRecord {
    sender: PublicKey;
    amount: number;
    provider: PublicKey;
    timestamp: number;
    auditorEpoch: number;
    /** On-chain account address of the AuditRecord PDA */
    address: PublicKey;
    batchId: number;
    index: number;
}
/** Raw on-chain audit record data */
export interface RawAuditRecord {
    address: PublicKey;
    vault: PublicKey;
    batchId: number;
    index: number;
    encryptedSender: Uint8Array;
    encryptedAmount: Uint8Array;
    provider: PublicKey;
    timestamp: number;
    auditorEpoch: number;
}
/**
 * AuditTool for decrypting Subly402 audit records.
 *
 * Usage:
 *   // Full audit (master key)
 *   const tool = new AuditTool(masterSecret);
 *   const all = await tool.decryptAll(vaultAddress, connection, programId);
 *
 *   // Provider-scoped audit (derived key)
 *   const records = await tool.decryptForProvider(vaultAddress, providerAddress, connection, programId);
 *
 *   // Export key for third-party auditor
 *   const exportedKey = tool.exportProviderKey(providerAddress);
 */
export declare class AuditTool {
    private masterSecret;
    constructor(masterSecret: Uint8Array | Buffer);
    /**
     * Decrypt all audit records for a vault using the master secret.
     * Iterates through providers and derives appropriate keys.
     */
    decryptAll(vaultAddress: PublicKey, connection: Connection, programId: PublicKey): Promise<DecryptedAuditRecord[]>;
    /**
     * Decrypt only audit records for a specific provider.
     */
    decryptForProvider(vaultAddress: PublicKey, providerAddress: PublicKey, connection: Connection, programId: PublicKey): Promise<DecryptedAuditRecord[]>;
    /**
     * Decrypt audit records using an externally-provided derived key.
     * Used when a third party has received an exported provider key.
     */
    static decryptWithKey(derivedSecret: Uint8Array, rawRecords: RawAuditRecord[]): Promise<DecryptedAuditRecord[]>;
    /**
     * Export a provider-derived secret key for selective disclosure.
     * The exported key can decrypt only that provider's audit records.
     */
    exportProviderKey(providerAddress: PublicKey): Promise<Uint8Array>;
    /**
     * Derive provider-specific secret from master secret via HKDF.
     * Matches enclave audit.rs derive_provider_key().
     */
    private deriveProviderSecret;
    /**
     * Decrypt a single audit record with a derived secret.
     */
    private decryptRecord;
    /**
     * Fetch all AuditRecord PDAs for a vault from on-chain.
     */
    private fetchAuditRecords;
}
//# sourceMappingURL=audit.d.ts.map