/**
 * Post-Quantum Migration Utilities
 *
 * Provides utilities for migrating from classical cryptography to post-quantum:
 * - Key rotation from classical to hybrid to PQ-only
 * - Dual-signature verification for transition period
 * - Gradual rollout support with feature flags
 * - Algorithm negotiation for interoperability
 *
 * Migration Strategy:
 * 1. CLASSICAL_ONLY: Current state, classical algorithms only
 * 2. HYBRID: Both classical and PQ algorithms, both must pass
 * 3. PQ_PRIMARY: PQ algorithms primary, classical for backward compatibility
 * 4. PQ_ONLY: Post-quantum algorithms only, classical deprecated
 *
 * @packageDocumentation
 * @module security/crypto/post-quantum/migration
 */
import { VorionError } from '../../../common/errors.js';
import { type MigrationPhase, type KeyRotationStatus, type AlgorithmNegotiationRequest, type AlgorithmNegotiationResult, type KyberParameterSet, type DilithiumParameterSet, type ClassicalKEMAlgorithm, type ClassicalSignatureAlgorithm, type HybridKEMKeyPair, type HybridSignatureKeyPair } from './types.js';
/**
 * Migration-specific error
 */
export declare class MigrationError extends VorionError {
    readonly errorCode: string;
    code: string;
    statusCode: number;
    constructor(message: string, errorCode?: string, details?: Record<string, unknown>);
}
/**
 * Migration configuration
 */
export interface MigrationConfig {
    /** Current migration phase */
    currentPhase: MigrationPhase;
    /** Target migration phase */
    targetPhase: MigrationPhase;
    /** Key rotation interval in days */
    keyRotationIntervalDays: number;
    /** Grace period for old keys in days */
    keyGracePeriodDays: number;
    /** Preferred PQ KEM algorithm */
    preferredKEM: KyberParameterSet;
    /** Preferred PQ signature algorithm */
    preferredSignature: DilithiumParameterSet;
    /** Preferred classical KEM algorithm */
    classicalKEM: ClassicalKEMAlgorithm;
    /** Preferred classical signature algorithm */
    classicalSignature: ClassicalSignatureAlgorithm;
    /** Enable dual-signature verification */
    enableDualVerification: boolean;
    /** Require both signatures in hybrid mode */
    requireBothSignatures: boolean;
    /** Enable gradual rollout (percentage-based) */
    enableGradualRollout: boolean;
    /** Rollout percentage (0-100) */
    rolloutPercentage: number;
}
/**
 * Manages key rotation during PQ migration
 */
export declare class KeyRotationManager {
    private readonly config;
    private readonly kyber;
    private readonly dilithium;
    private readonly hybridProvider;
    private currentKEMKeys;
    private currentSignatureKeys;
    private keyRotationStatus;
    constructor(config?: Partial<MigrationConfig>);
    /**
     * Initialize the manager
     */
    initialize(): Promise<void>;
    /**
     * Rotate KEM keys from classical to hybrid
     */
    rotateKEMKey(keyId: string): Promise<{
        newKeyPair: HybridKEMKeyPair;
        status: KeyRotationStatus;
    }>;
    /**
     * Rotate signature keys from classical to hybrid
     */
    rotateSignatureKey(keyId: string): Promise<{
        newKeyPair: HybridSignatureKeyPair;
        status: KeyRotationStatus;
    }>;
    /**
     * Get key rotation status
     */
    getKeyRotationStatus(keyId: string): KeyRotationStatus | undefined;
    /**
     * Check if key rotation is due
     */
    isRotationDue(keyId: string): boolean;
    /**
     * Get current migration phase
     */
    getCurrentPhase(): MigrationPhase;
    /**
     * Advance to next migration phase
     */
    advancePhase(): MigrationPhase;
    /**
     * Get stored KEM key pair
     */
    getKEMKeyPair(keyId: string): HybridKEMKeyPair | undefined;
    /**
     * Get stored signature key pair
     */
    getSignatureKeyPair(keyId: string): HybridSignatureKeyPair | undefined;
}
/**
 * Verifies signatures during migration, supporting both classical and hybrid
 */
export declare class DualSignatureVerifier {
    private readonly config;
    private readonly dilithium;
    private readonly hybridProvider;
    constructor(config?: Partial<MigrationConfig>);
    /**
     * Initialize the verifier
     */
    initialize(): Promise<void>;
    /**
     * Verify a signature, automatically detecting if it's classical or hybrid
     */
    verify(publicKey: HybridSignatureKeyPair | {
        classicalPublicKey: Uint8Array;
        pqPublicKey?: Uint8Array;
    }, message: Uint8Array, signature: Uint8Array): Promise<{
        valid: boolean;
        signatureType: 'classical' | 'hybrid' | 'pq-only';
        classicalValid?: boolean;
        pqValid?: boolean;
        error?: string;
    }>;
    /**
     * Verify with explicit signature type
     */
    verifyExplicit(publicKey: HybridSignatureKeyPair, message: Uint8Array, signature: Uint8Array, signatureType: 'classical' | 'hybrid' | 'pq-only'): Promise<{
        valid: boolean;
        error?: string;
    }>;
}
/**
 * Manages gradual rollout of PQ cryptography
 */
export declare class GradualRolloutManager {
    private readonly config;
    constructor(config?: Partial<MigrationConfig>);
    /**
     * Check if a user/entity should use PQ cryptography
     * Uses consistent hashing for deterministic rollout
     */
    shouldUsePQ(entityId: string): boolean;
    /**
     * Get the appropriate migration phase for an entity
     */
    getPhaseForEntity(entityId: string): MigrationPhase;
    /**
     * Update rollout percentage
     */
    setRolloutPercentage(percentage: number): void;
    /**
     * Get current rollout percentage
     */
    getRolloutPercentage(): number;
    /**
     * Check rollout status
     */
    getRolloutStatus(): {
        enabled: boolean;
        percentage: number;
        currentPhase: MigrationPhase;
        targetPhase: MigrationPhase;
    };
}
/**
 * Negotiates cryptographic algorithms between parties
 */
export declare class AlgorithmNegotiator {
    private readonly config;
    private readonly kemPreferenceOrder;
    private readonly signaturePreferenceOrder;
    constructor(config?: Partial<MigrationConfig>);
    /**
     * Negotiate algorithms with a peer
     */
    negotiate(request: AlgorithmNegotiationRequest): AlgorithmNegotiationResult;
    /**
     * Get supported KEM algorithms for the current phase
     */
    private getAvailableKEM;
    /**
     * Get supported signature algorithms for the current phase
     */
    private getAvailableSignatures;
    /**
     * Create a negotiation request
     */
    createNegotiationRequest(): AlgorithmNegotiationRequest;
}
/**
 * Create a KeyRotationManager
 */
export declare function createKeyRotationManager(config?: Partial<MigrationConfig>): KeyRotationManager;
/**
 * Create a DualSignatureVerifier
 */
export declare function createDualSignatureVerifier(config?: Partial<MigrationConfig>): DualSignatureVerifier;
/**
 * Create a GradualRolloutManager
 */
export declare function createGradualRolloutManager(config?: Partial<MigrationConfig>): GradualRolloutManager;
/**
 * Create an AlgorithmNegotiator
 */
export declare function createAlgorithmNegotiator(config?: Partial<MigrationConfig>): AlgorithmNegotiator;
/**
 * Create a complete migration toolkit
 */
export declare function createMigrationToolkit(config?: Partial<MigrationConfig>): Promise<{
    keyRotation: KeyRotationManager;
    dualVerifier: DualSignatureVerifier;
    rollout: GradualRolloutManager;
    negotiator: AlgorithmNegotiator;
}>;
//# sourceMappingURL=migration.d.ts.map