/**
 * @fileoverview IdentitySealingPipeline — orchestrates the brokered anonymity flow.
 *
 * Captures real identity, generates Shamir shards, replaces identity field,
 * distributes encrypted shards, stores IdentityRecoveryRecord, and discards plaintext.
 *
 * @see Requirements 14
 * @see Design: IdentitySealingPipeline (Section 6)
 */
import { ECIESService, HexString, PlatformID } from '@digitaldefiance/ecies-lib';
import { BrightTrustEpoch } from '../interfaces/brightTrustEpoch';
import { ContentWithIdentity, IdentityMode } from '../interfaces/contentWithIdentity';
import { IBrightTrustDatabase } from '../interfaces/services/brightTrustDatabase';
import { IdentitySealingResult, IIdentitySealingPipeline } from '../interfaces/services/identitySealingPipeline';
import { StatuteOfLimitationsConfig } from '../interfaces/statuteConfig';
import { SealingService } from './sealing.service';
/**
 * Anonymous_ID: an all-zeroes 16-byte Uint8Array used as the creatorId
 * when content is posted with no identity attribution.
 */
export declare const ANONYMOUS_ID: Uint8Array<ArrayBuffer>;
/**
 * IdentitySealingPipeline orchestrates the brokered anonymity flow:
 *
 * 1. Captures the real creator identity before publication
 * 2. Generates Shamir shards from the identity bytes
 * 3. Replaces the identity field based on mode (real/alias/anonymous)
 * 4. Encrypts each shard with the corresponding BrightTrust member's public key via ECIES
 * 5. Verifies shards correctly reconstruct before distributing
 * 6. Stores the IdentityRecoveryRecord in the BrightTrustDatabase
 * 7. Attaches the recovery record ID to the content metadata
 * 8. Discards the original plaintext identity from memory
 *
 * @template TID - Platform ID type for frontend/backend DTO compatibility
 */
export declare class IdentitySealingPipeline<TID extends PlatformID = Uint8Array> implements IIdentitySealingPipeline<TID> {
    private readonly db;
    private readonly sealingService;
    private readonly eciesService;
    private readonly currentEpoch;
    private readonly statuteConfig;
    constructor(db: IBrightTrustDatabase<TID>, sealingService: SealingService<TID>, eciesService: ECIESService<TID>, currentEpoch: () => Promise<BrightTrustEpoch<TID>>, statuteConfig: () => Promise<StatuteOfLimitationsConfig | null>);
    /**
     * Get the enhanced ID provider from the sealing service for TID ↔ bytes conversion.
     */
    private get enhancedProvider();
    /**
     * Convert a TID to its byte representation.
     */
    private tidToBytes;
    /**
     * Convert bytes back to a TID.
     */
    private bytesToTid;
    /**
     * Compute the expiration date for an identity recovery record
     * based on the statute of limitations configuration.
     */
    private computeExpiresAt;
    /**
     * Process content through the identity sealing pipeline.
     *
     * Steps:
     * 1. Capture the real identity (creatorId) from the content
     * 2. Convert identity to hex for Shamir splitting
     * 3. Generate Shamir shards using current epoch threshold/members
     * 4. Verify shards reconstruct correctly before distributing (Task 15.3)
     * 5. Replace identity field based on mode (Task 15.4)
     * 6. Encrypt each shard with the corresponding member's public key via ECIES
     * 7. Store the IdentityRecoveryRecord
     * 8. Attach recovery record ID to content
     * 9. Wipe plaintext identity from memory
     *
     * @param content - The content with real identity to seal
     * @param mode - The identity mode (real, alias, or anonymous)
     * @param aliasName - Required when mode is Alias
     * @returns The modified content and recovery record ID
     * @throws BrightTrustError with IdentitySealingFailed if shard generation or distribution fails
     * @throws BrightTrustError with ShardVerificationFailed if shard verification fails
     */
    sealIdentity(content: ContentWithIdentity<TID>, mode: IdentityMode, aliasName?: string): Promise<IdentitySealingResult<TID>>;
    /**
     * Recover a sealed identity given sufficient decrypted shares.
     *
     * Retrieves the IdentityRecoveryRecord, validates share count,
     * reconstructs the identity using Shamir's combine, and returns the TID.
     *
     * @param recoveryRecordId - The ID of the identity recovery record
     * @param decryptedShares - Map of member ID to decrypted share hex string
     * @returns The recovered real identity
     * @throws BrightTrustError with InsufficientSharesForReconstruction if not enough shares
     * @throws BrightTrustError with IdentityPermanentlyUnrecoverable if record not found
     */
    recoverIdentity(recoveryRecordId: HexString, decryptedShares: Map<HexString, string>): Promise<TID>;
    /**
     * Verify that Shamir shards correctly reconstruct the original identity
     * before distributing them to members.
     *
     * Takes a subset of shares (threshold count) and verifies they
     * reconstruct to the original identity hex.
     *
     * @param shares - The plaintext Shamir shares
     * @param threshold - The number of shares needed to reconstruct
     * @param originalHex - The original identity hex string
     * @param totalShares - Total number of shares generated
     * @throws BrightTrustError with ShardVerificationFailed if verification fails
     */
    private verifyShards;
    /**
     * Replace the identity field on content based on the selected mode.
     *
     * - Real: keep creatorId as-is
     * - Alias: replace creatorId with the alias name encoded as TID
     * - Anonymous: replace creatorId with ANONYMOUS_ID (all-zeroes)
     *
     * Returns a shallow copy of the content with the identity replaced.
     */
    private replaceIdentity;
}
//# sourceMappingURL=identitySealingPipeline.d.ts.map