// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * Post-Quantum Cryptography Types
 *
 * Type definitions for post-quantum cryptographic operations including:
 * - CRYSTALS-Kyber key encapsulation mechanism (KEM)
 * - CRYSTALS-Dilithium digital signatures
 * - Hybrid classical/PQ modes
 *
 * Based on NIST PQC standardization (FIPS 203, FIPS 204)
 *
 * @packageDocumentation
 * @module security/crypto/post-quantum/types
 */
import { z } from 'zod';
// =============================================================================
// Kyber (ML-KEM) Types - FIPS 203
// =============================================================================
/**
 * Kyber parameter sets as defined in FIPS 203
 * - kyber512: NIST Security Level 1 (equivalent to AES-128)
 * - kyber768: NIST Security Level 3 (equivalent to AES-192)
 * - kyber1024: NIST Security Level 5 (equivalent to AES-256)
 */
export const KyberParameterSet = {
    KYBER512: 'kyber512',
    KYBER768: 'kyber768',
    KYBER1024: 'kyber1024',
};
export const kyberParameterSetSchema = z.nativeEnum(KyberParameterSet);
/**
 * Kyber parameter specifications for each security level
 */
export const KYBER_PARAMETERS = {
    [KyberParameterSet.KYBER512]: {
        name: KyberParameterSet.KYBER512,
        securityLevel: 1,
        publicKeySize: 800,
        privateKeySize: 1632,
        ciphertextSize: 768,
        sharedSecretSize: 32,
        k: 2,
    },
    [KyberParameterSet.KYBER768]: {
        name: KyberParameterSet.KYBER768,
        securityLevel: 3,
        publicKeySize: 1184,
        privateKeySize: 2400,
        ciphertextSize: 1088,
        sharedSecretSize: 32,
        k: 3,
    },
    [KyberParameterSet.KYBER1024]: {
        name: KyberParameterSet.KYBER1024,
        securityLevel: 5,
        publicKeySize: 1568,
        privateKeySize: 3168,
        ciphertextSize: 1568,
        sharedSecretSize: 32,
        k: 4,
    },
};
// =============================================================================
// Dilithium (ML-DSA) Types - FIPS 204
// =============================================================================
/**
 * Dilithium parameter sets as defined in FIPS 204
 * - dilithium2: NIST Security Level 2 (recommended minimum)
 * - dilithium3: NIST Security Level 3
 * - dilithium5: NIST Security Level 5
 */
export const DilithiumParameterSet = {
    DILITHIUM2: 'dilithium2',
    DILITHIUM3: 'dilithium3',
    DILITHIUM5: 'dilithium5',
};
export const dilithiumParameterSetSchema = z.nativeEnum(DilithiumParameterSet);
/**
 * Dilithium parameter specifications for each security level
 */
export const DILITHIUM_PARAMETERS = {
    [DilithiumParameterSet.DILITHIUM2]: {
        name: DilithiumParameterSet.DILITHIUM2,
        securityLevel: 2,
        publicKeySize: 1312,
        privateKeySize: 2560,
        signatureSize: 2420,
        k: 4,
        l: 4,
    },
    [DilithiumParameterSet.DILITHIUM3]: {
        name: DilithiumParameterSet.DILITHIUM3,
        securityLevel: 3,
        publicKeySize: 1952,
        privateKeySize: 4032,
        signatureSize: 3309,
        k: 6,
        l: 5,
    },
    [DilithiumParameterSet.DILITHIUM5]: {
        name: DilithiumParameterSet.DILITHIUM5,
        securityLevel: 5,
        publicKeySize: 2592,
        privateKeySize: 4896,
        signatureSize: 4627,
        k: 8,
        l: 7,
    },
};
export const pqKeyPairSchema = z.object({
    publicKey: z.instanceof(Uint8Array),
    privateKey: z.instanceof(Uint8Array),
    algorithm: z.union([kyberParameterSetSchema, dilithiumParameterSetSchema]),
    generatedAt: z.coerce.date().optional(),
    expiresAt: z.coerce.date().optional(),
    keyId: z.string().optional(),
});
export const encapsulationResultSchema = z.object({
    ciphertext: z.instanceof(Uint8Array),
    sharedSecret: z.instanceof(Uint8Array),
});
export const decapsulationResultSchema = z.object({
    sharedSecret: z.instanceof(Uint8Array),
    success: z.boolean(),
});
export const signatureResultSchema = z.object({
    signature: z.instanceof(Uint8Array),
    algorithm: dilithiumParameterSetSchema,
    messageDigest: z.instanceof(Uint8Array).optional(),
});
export const verificationResultSchema = z.object({
    valid: z.boolean(),
    error: z.string().optional(),
});
// =============================================================================
// Hybrid Mode Types
// =============================================================================
/**
 * Classical algorithm for hybrid KEM
 */
export const ClassicalKEMAlgorithm = {
    X25519: 'x25519',
    ECDH_P256: 'ecdh-p256',
    ECDH_P384: 'ecdh-p384',
};
export const classicalKEMAlgorithmSchema = z.nativeEnum(ClassicalKEMAlgorithm);
/**
 * Classical algorithm for hybrid signatures
 */
export const ClassicalSignatureAlgorithm = {
    ED25519: 'ed25519',
    ECDSA_P256: 'ecdsa-p256',
    ECDSA_P384: 'ecdsa-p384',
};
export const classicalSignatureAlgorithmSchema = z.nativeEnum(ClassicalSignatureAlgorithm);
export const hybridKEMKeyPairSchema = z.object({
    classicalPublicKey: z.instanceof(Uint8Array),
    classicalPrivateKey: z.instanceof(Uint8Array),
    pqPublicKey: z.instanceof(Uint8Array),
    pqPrivateKey: z.instanceof(Uint8Array),
    classicalAlgorithm: classicalKEMAlgorithmSchema,
    pqAlgorithm: kyberParameterSetSchema,
    keyId: z.string().optional(),
    generatedAt: z.coerce.date().optional(),
});
export const hybridSignatureKeyPairSchema = z.object({
    classicalPublicKey: z.instanceof(Uint8Array),
    classicalPrivateKey: z.instanceof(Uint8Array),
    pqPublicKey: z.instanceof(Uint8Array),
    pqPrivateKey: z.instanceof(Uint8Array),
    classicalAlgorithm: classicalSignatureAlgorithmSchema,
    pqAlgorithm: dilithiumParameterSetSchema,
    keyId: z.string().optional(),
    generatedAt: z.coerce.date().optional(),
});
export const hybridEncapsulationResultSchema = z.object({
    ciphertext: z.instanceof(Uint8Array),
    classicalCiphertext: z.instanceof(Uint8Array),
    pqCiphertext: z.instanceof(Uint8Array),
    sharedSecret: z.instanceof(Uint8Array),
});
export const hybridSignatureResultSchema = z.object({
    signature: z.instanceof(Uint8Array),
    classicalSignature: z.instanceof(Uint8Array),
    pqSignature: z.instanceof(Uint8Array),
    classicalAlgorithm: classicalSignatureAlgorithmSchema,
    pqAlgorithm: dilithiumParameterSetSchema,
});
export const kyberConfigSchema = z.object({
    defaultParameterSet: kyberParameterSetSchema.default(KyberParameterSet.KYBER768),
    enableHybridMode: z.boolean().default(true),
    hybridClassicalAlgorithm: classicalKEMAlgorithmSchema.default(ClassicalKEMAlgorithm.X25519),
    preferNativeBindings: z.boolean().default(true),
});
export const DEFAULT_KYBER_CONFIG = {
    defaultParameterSet: KyberParameterSet.KYBER768,
    enableHybridMode: true,
    hybridClassicalAlgorithm: ClassicalKEMAlgorithm.X25519,
    preferNativeBindings: true,
};
export const dilithiumConfigSchema = z.object({
    defaultParameterSet: dilithiumParameterSetSchema.default(DilithiumParameterSet.DILITHIUM3),
    enableHybridMode: z.boolean().default(true),
    hybridClassicalAlgorithm: classicalSignatureAlgorithmSchema.default(ClassicalSignatureAlgorithm.ED25519),
    preferNativeBindings: z.boolean().default(true),
    preHashMessages: z.boolean().default(false),
    preHashAlgorithm: z.enum(['sha256', 'sha384', 'sha512']).default('sha256'),
});
export const DEFAULT_DILITHIUM_CONFIG = {
    defaultParameterSet: DilithiumParameterSet.DILITHIUM3,
    enableHybridMode: true,
    hybridClassicalAlgorithm: ClassicalSignatureAlgorithm.ED25519,
    preferNativeBindings: true,
    preHashMessages: false,
    preHashAlgorithm: 'sha256',
};
export const hybridConfigSchema = z.object({
    requireBothValid: z.boolean().default(true),
    backwardCompatibilityMode: z.boolean().default(false),
    kem: z.object({
        classicalAlgorithm: classicalKEMAlgorithmSchema.default(ClassicalKEMAlgorithm.X25519),
        pqAlgorithm: kyberParameterSetSchema.default(KyberParameterSet.KYBER768),
    }),
    signature: z.object({
        classicalAlgorithm: classicalSignatureAlgorithmSchema.default(ClassicalSignatureAlgorithm.ED25519),
        pqAlgorithm: dilithiumParameterSetSchema.default(DilithiumParameterSet.DILITHIUM3),
    }),
});
export const DEFAULT_HYBRID_CONFIG = {
    requireBothValid: true,
    backwardCompatibilityMode: false,
    kem: {
        classicalAlgorithm: ClassicalKEMAlgorithm.X25519,
        pqAlgorithm: KyberParameterSet.KYBER768,
    },
    signature: {
        classicalAlgorithm: ClassicalSignatureAlgorithm.ED25519,
        pqAlgorithm: DilithiumParameterSet.DILITHIUM3,
    },
};
// =============================================================================
// Error Types
// =============================================================================
/**
 * Post-quantum cryptography error codes
 */
export const PQErrorCode = {
    /** Key generation failed */
    KEY_GENERATION_FAILED: 'PQ_KEY_GENERATION_FAILED',
    /** Encapsulation failed */
    ENCAPSULATION_FAILED: 'PQ_ENCAPSULATION_FAILED',
    /** Decapsulation failed */
    DECAPSULATION_FAILED: 'PQ_DECAPSULATION_FAILED',
    /** Signing failed */
    SIGNING_FAILED: 'PQ_SIGNING_FAILED',
    /** Verification failed */
    VERIFICATION_FAILED: 'PQ_VERIFICATION_FAILED',
    /** Invalid key format */
    INVALID_KEY_FORMAT: 'PQ_INVALID_KEY_FORMAT',
    /** Invalid parameter set */
    INVALID_PARAMETER_SET: 'PQ_INVALID_PARAMETER_SET',
    /** Native bindings not available */
    NATIVE_BINDINGS_UNAVAILABLE: 'PQ_NATIVE_BINDINGS_UNAVAILABLE',
    /** Hybrid mode error */
    HYBRID_MODE_ERROR: 'PQ_HYBRID_MODE_ERROR',
    /** Algorithm mismatch */
    ALGORITHM_MISMATCH: 'PQ_ALGORITHM_MISMATCH',
    /** Key expired */
    KEY_EXPIRED: 'PQ_KEY_EXPIRED',
    /** Migration error */
    MIGRATION_ERROR: 'PQ_MIGRATION_ERROR',
};
// =============================================================================
// Migration Types
// =============================================================================
/**
 * Migration phase for classical to PQ transition
 */
export const MigrationPhase = {
    /** Classical only (pre-migration) */
    CLASSICAL_ONLY: 'classical-only',
    /** Hybrid mode (both classical and PQ) */
    HYBRID: 'hybrid',
    /** PQ primary with classical fallback */
    PQ_PRIMARY: 'pq-primary',
    /** PQ only (post-migration) */
    PQ_ONLY: 'pq-only',
};
export const migrationPhaseSchema = z.nativeEnum(MigrationPhase);
export const keyRotationStatusSchema = z.object({
    currentKeyId: z.string(),
    previousKeyId: z.string().optional(),
    phase: migrationPhaseSchema,
    rotatedAt: z.coerce.date(),
    nextRotationAt: z.coerce.date().optional(),
    classicalKeyActive: z.boolean(),
    pqKeyActive: z.boolean(),
});
export const algorithmNegotiationRequestSchema = z.object({
    supportedKEM: z.array(z.union([classicalKEMAlgorithmSchema, kyberParameterSetSchema])),
    supportedSignatures: z.array(z.union([classicalSignatureAlgorithmSchema, dilithiumParameterSetSchema])),
    preferred: z.object({
        kem: z.union([classicalKEMAlgorithmSchema, kyberParameterSetSchema]).optional(),
        signature: z.union([classicalSignatureAlgorithmSchema, dilithiumParameterSetSchema]).optional(),
    }).optional(),
    hybridSupported: z.boolean(),
});
export const algorithmNegotiationResultSchema = z.object({
    selectedKEM: z.union([classicalKEMAlgorithmSchema, kyberParameterSetSchema, z.null()]),
    selectedSignature: z.union([classicalSignatureAlgorithmSchema, dilithiumParameterSetSchema, z.null()]),
    hybridMode: z.boolean(),
    success: z.boolean(),
    error: z.string().optional(),
});
// =============================================================================
// Benchmark Types
// =============================================================================
/**
 * Benchmark operation type
 */
export const BenchmarkOperation = {
    KEY_GENERATION: 'key_generation',
    ENCAPSULATION: 'encapsulation',
    DECAPSULATION: 'decapsulation',
    SIGN: 'sign',
    VERIFY: 'verify',
};
export const benchmarkResultSchema = z.object({
    operation: z.nativeEnum(BenchmarkOperation),
    algorithm: z.string(),
    iterations: z.number().int().positive(),
    totalTimeMs: z.number().nonnegative(),
    avgTimeMs: z.number().nonnegative(),
    minTimeMs: z.number().nonnegative(),
    maxTimeMs: z.number().nonnegative(),
    stdDevMs: z.number().nonnegative(),
    opsPerSecond: z.number().nonnegative(),
    memoryUsageBytes: z.number().int().nonnegative().optional(),
});
export const benchmarkSuiteResultSchema = z.object({
    timestamp: z.coerce.date(),
    platform: z.object({
        nodeVersion: z.string(),
        arch: z.string(),
        cpuModel: z.string(),
        cpuCores: z.number().int().positive(),
    }),
    results: z.array(benchmarkResultSchema),
    nativeBindingsUsed: z.boolean(),
});
//# sourceMappingURL=types.js.map