import { VorionError } from '../../../common/errors.js';
import { type HybridConfig, type HybridKEMKeyPair, type HybridSignatureKeyPair, type HybridEncapsulationResult, type HybridSignatureResult, type KyberParameterSet, type DilithiumParameterSet, type ClassicalKEMAlgorithm, type ClassicalSignatureAlgorithm } from './types.js';
/**
 * Hybrid mode error
 */
export declare class HybridCryptoError extends VorionError {
    readonly errorCode: string;
    code: string;
    statusCode: number;
    constructor(message: string, errorCode?: string, details?: Record<string, unknown>);
}
/**
 * Configuration for Hybrid KEM
 */
export interface HybridKEMConfig {
    /** Classical algorithm */
    classicalAlgorithm: ClassicalKEMAlgorithm;
    /** Post-quantum algorithm (Kyber) */
    pqAlgorithm: KyberParameterSet;
    /** Key derivation info string */
    kdfInfo: string;
    /** Require both classical and PQ to succeed */
    requireBothValid: boolean;
}
/**
 * Hybrid Key Encapsulation Mechanism combining X25519/ECDH + Kyber
 *
 * Provides IND-CCA2 security assuming either the classical or PQ scheme is secure.
 *
 * @example
 * ```typescript
 * const hybridKEM = new HybridKEM();
 *
 * // Generate key pair
 * const keyPair = await hybridKEM.generateKeyPair();
 *
 * // Encapsulate (sender)
 * const { ciphertext, sharedSecret } = await hybridKEM.encapsulate(keyPair);
 *
 * // Decapsulate (recipient)
 * const { sharedSecret: recovered } = await hybridKEM.decapsulate(keyPair, ciphertext);
 * ```
 */
export declare class HybridKEM {
    private readonly config;
    private readonly kyber;
    constructor(config?: Partial<HybridKEMConfig>);
    /**
     * Initialize the hybrid KEM
     */
    initialize(): Promise<void>;
    /**
     * Generate a hybrid key pair
     */
    generateKeyPair(): Promise<HybridKEMKeyPair>;
    /**
     * Encapsulate a shared secret
     */
    encapsulate(keyPair: HybridKEMKeyPair): Promise<HybridEncapsulationResult>;
    /**
     * Decapsulate a shared secret
     */
    decapsulate(keyPair: HybridKEMKeyPair, ciphertext: Uint8Array): Promise<{
        sharedSecret: Uint8Array;
        success: boolean;
    }>;
    /**
     * Get configuration
     */
    getConfig(): Readonly<HybridKEMConfig>;
}
/**
 * Configuration for Hybrid Signatures
 */
export interface HybridSignatureConfig {
    /** Classical algorithm */
    classicalAlgorithm: ClassicalSignatureAlgorithm;
    /** Post-quantum algorithm (Dilithium) */
    pqAlgorithm: DilithiumParameterSet;
    /** Require both signatures to be valid */
    requireBothValid: boolean;
    /** Accept classical-only signatures (backward compatibility) */
    acceptClassicalOnly: boolean;
}
/**
 * Hybrid Digital Signature combining Ed25519/ECDSA + Dilithium
 *
 * Provides EUF-CMA security assuming either the classical or PQ scheme is secure.
 *
 * @example
 * ```typescript
 * const hybridSig = new HybridSign();
 *
 * // Generate key pair
 * const keyPair = await hybridSig.generateKeyPair();
 *
 * // Sign message
 * const message = new TextEncoder().encode('Hello, hybrid world!');
 * const { signature } = await hybridSig.sign(keyPair, message);
 *
 * // Verify signature
 * const { valid } = await hybridSig.verify(keyPair, message, signature);
 * ```
 */
export declare class HybridSign {
    private readonly config;
    private readonly dilithium;
    constructor(config?: Partial<HybridSignatureConfig>);
    /**
     * Initialize the hybrid signature service
     */
    initialize(): Promise<void>;
    /**
     * Generate a hybrid signature key pair
     */
    generateKeyPair(): Promise<HybridSignatureKeyPair>;
    /**
     * Sign a message with hybrid signature
     */
    sign(keyPair: HybridSignatureKeyPair, message: Uint8Array): Promise<HybridSignatureResult>;
    /**
     * Verify a hybrid signature
     */
    verify(keyPair: HybridSignatureKeyPair, message: Uint8Array, signature: Uint8Array): Promise<{
        valid: boolean;
        classicalValid: boolean;
        pqValid: boolean;
        error?: string;
    }>;
    /**
     * Verify a classical-only signature (backward compatibility)
     */
    verifyClassicalOnly(classicalPublicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): Promise<{
        valid: boolean;
        error?: string;
    }>;
    /**
     * Get configuration
     */
    getConfig(): Readonly<HybridSignatureConfig>;
}
/**
 * Unified hybrid cryptography provider with configurable algorithm selection
 *
 * Supports:
 * - Dynamic algorithm selection
 * - Backward compatibility modes
 * - Gradual PQ migration
 */
export declare class HybridCryptoProvider {
    private readonly config;
    private readonly kem;
    private readonly sign;
    private initialized;
    constructor(config?: Partial<HybridConfig>);
    /**
     * Initialize the provider
     */
    initialize(): Promise<void>;
    /**
     * Ensure provider is initialized
     */
    private ensureInitialized;
    /**
     * Generate a hybrid KEM key pair
     */
    generateKEMKeyPair(): Promise<HybridKEMKeyPair>;
    /**
     * Encapsulate a shared secret
     */
    encapsulate(keyPair: HybridKEMKeyPair): Promise<HybridEncapsulationResult>;
    /**
     * Decapsulate a shared secret
     */
    decapsulate(keyPair: HybridKEMKeyPair, ciphertext: Uint8Array): Promise<{
        sharedSecret: Uint8Array;
        success: boolean;
    }>;
    /**
     * Generate a hybrid signature key pair
     */
    generateSignatureKeyPair(): Promise<HybridSignatureKeyPair>;
    /**
     * Sign a message
     */
    signMessage(keyPair: HybridSignatureKeyPair, message: Uint8Array): Promise<HybridSignatureResult>;
    /**
     * Verify a signature
     */
    verifySignature(keyPair: HybridSignatureKeyPair, message: Uint8Array, signature: Uint8Array): Promise<{
        valid: boolean;
        classicalValid: boolean;
        pqValid: boolean;
        error?: string;
    }>;
    /**
     * Verify a classical-only signature (backward compatibility)
     */
    verifyClassicalSignature(classicalPublicKey: Uint8Array, message: Uint8Array, signature: Uint8Array): Promise<{
        valid: boolean;
        error?: string;
    }>;
    /**
     * Get current configuration
     */
    getConfig(): Readonly<HybridConfig>;
    /**
     * Check if backward compatibility mode is enabled
     */
    isBackwardCompatibilityEnabled(): boolean;
    /**
     * Get the KEM service
     */
    getKEMService(): HybridKEM;
    /**
     * Get the signature service
     */
    getSignatureService(): HybridSign;
}
/**
 * Create a HybridKEM instance
 */
export declare function createHybridKEM(config?: Partial<HybridKEMConfig>): HybridKEM;
/**
 * Create a HybridSign instance
 */
export declare function createHybridSign(config?: Partial<HybridSignatureConfig>): HybridSign;
/**
 * Create a HybridCryptoProvider instance
 */
export declare function createHybridCryptoProvider(config?: Partial<HybridConfig>): HybridCryptoProvider;
/**
 * Create and initialize a HybridCryptoProvider
 */
export declare function createInitializedHybridCryptoProvider(config?: Partial<HybridConfig>): Promise<HybridCryptoProvider>;
/**
 * Determine if a signature is hybrid or classical-only based on size
 */
export declare function isHybridSignature(signature: Uint8Array, classicalAlgorithm: ClassicalSignatureAlgorithm, pqAlgorithm: DilithiumParameterSet): boolean;
/**
 * Split a hybrid signature into components
 */
export declare function splitHybridSignature(signature: Uint8Array, classicalAlgorithm: ClassicalSignatureAlgorithm, pqAlgorithm: DilithiumParameterSet): {
    classicalSignature: Uint8Array;
    pqSignature: Uint8Array;
} | null;
//# sourceMappingURL=hybrid.d.ts.map