import { ECIESService, HexString, Member, PlatformID, TypedIdProviderWrapper } from '@digitaldefiance/ecies-lib';
import type { Shares } from '@digitaldefiance/secrets';
import { BrightTrustDataRecord } from '../brightTrustDataRecord';
/**
 * Service for handling sealing operations using Shamir's Secret Sharing.
 * This service provides functionality for:
 * - Splitting secrets into shares using Shamir's Secret Sharing
 * - Encrypting shares for members using ECIES
 * - Recombining shares to recover secrets
 * - Managing BrightTrust-based data access
 */
export declare class SealingService<TID extends PlatformID = Uint8Array> {
    private readonly eciesService;
    private readonly enhancedProvider;
    constructor(eciesService: ECIESService<TID>, enhancedProvider: TypedIdProviderWrapper<TID>);
    /** Public accessor for the ECIES service (needed by BrightTrustStateMachine for member resolution). */
    get eciesServiceRef(): ECIESService<TID>;
    /** Public accessor for the enhanced ID provider (needed by BrightTrustStateMachine for member resolution). */
    get enhancedProviderRef(): TypedIdProviderWrapper<TID>;
    /**
     * Reconfigure secrets.js to have the right number of bits for the number of shares needed
     * @param maxShares Maximum number of shares to support
     */
    reinitSecrets(maxShares: number): void;
    /**
     * Reconfigure secrets.js for bootstrap mode, allowing share counts as low as 1.
     * Bypasses the SEALING.MIN_SHARES constraint.
     * @param maxShares Maximum number of shares to support (minimum 1)
     */
    reinitSecretsForBootstrap(maxShares: number): void;
    /**
     * Validate inputs for BrightTrust sealing operations
     */
    static validateBrightTrustSealInputs<TID extends PlatformID = Uint8Array>(amongstMembers: Member<TID>[], sharesRequired?: number): void;
    /**
     * Validate inputs for bootstrap sealing operations.
     * Allows threshold=1 and shareCount=1, bypassing SEALING.MIN_SHARES.
     */
    static validateBootstrapSealInputs<TID extends PlatformID = Uint8Array>(amongstMembers: Member<TID>[], sharesRequired?: number): void;
    /**
     * Using Shamir's Secret Sharing, split the given data into the given number of shares
     * @param agent The member performing the sealing operation
     * @param data The data to seal
     * @param amongstMembers The members to distribute shares to
     * @param sharesRequired Optional number of shares required to unseal (defaults to all members)
     * @returns BrightTrustDataRecord containing the sealed data and encrypted shares
     * @throws {SealingError} If validation fails or sealing operation fails
     */
    brightTrustSeal<T>(agent: Member<TID>, data: T, amongstMembers: Member<TID>[], sharesRequired?: number): Promise<BrightTrustDataRecord<TID>>;
    /**
     * Seal data with bootstrap mode support (threshold can be 1).
     * Bypasses the SEALING.MIN_SHARES constraint for bootstrap mode operation.
     * @param agent The member performing the sealing operation
     * @param data The data to seal
     * @param amongstMembers The members to distribute shares to (can be 1)
     * @param threshold Optional number of shares required to unseal (defaults to member count, minimum 1)
     * @returns BrightTrustDataRecord containing the sealed data and encrypted shares
     * @throws {SealingError} If validation fails or sealing operation fails
     */
    brightTrustSealBootstrap<T>(agent: Member<TID>, data: T, amongstMembers: Member<TID>[], threshold?: number): Promise<BrightTrustDataRecord<TID>>;
    /**
     * Re-split an existing symmetric key under new membership parameters.
     * Requires threshold existing members to provide decrypted shares for key reconstruction.
     *
     * Algorithm:
     * 1. RECONSTRUCT: Combine decrypted shares to recover the original AES-256-GCM symmetric key
     * 2. RE-INIT: Configure Shamir library for new share count
     * 3. RE-SPLIT: Generate new shares with fresh polynomial coefficients
     * 4. ENCRYPT: ECIES-encrypt each new share with the corresponding member's public key
     * 5. WIPE: Zero out the reconstructed key and all plaintext shares from memory
     *
     * @param existingShares Decrypted shares from threshold members (member ID → share hex string)
     * @param newMembers The new member set to distribute shares to
     * @param newThreshold The new threshold for unsealing
     * @param existingSharingConfig The original sharing configuration (totalShares, threshold)
     * @returns Map of new ECIES-encrypted shares per member ID
     * @throws {SealingError} If reconstruction fails or validation fails
     */
    redistributeShares(existingShares: Map<HexString, string>, newMembers: Member<TID>[], newThreshold: number, existingSharingConfig: {
        totalShares: number;
        threshold: number;
    }): Promise<Map<HexString, Uint8Array>>;
    /**
     * Wipe a string from memory by overwriting its characters.
     * Note: Due to JavaScript string immutability, this creates a new string
     * of the same length filled with zeros. The original string will be
     * garbage collected. This is a best-effort approach in JavaScript.
     * @param str The string to wipe
     */
    private wipeString;
    /**
     * Securely wipe a Uint8Array by filling it with zeros.
     * @param buffer The buffer to wipe
     */
    private wipeBuffer;
    /**
     * Check if all members have their private keys loaded
     */
    static allMembersHavePrivateKey<TID extends PlatformID = Uint8Array>(members: Member<TID>[]): boolean;
    /**
     * Given a BrightTrust sealed document, decrypt the shares using the given members' private keys
     * @param document The sealed document
     * @param membersWithPrivateKey Members with loaded private keys
     * @returns Decrypted shares
     * @throws {SealingError} If validation fails or decryption fails
     */
    decryptShares(document: BrightTrustDataRecord<TID>, membersWithPrivateKey: Member<TID>[]): Promise<Shares>;
    /**
     * Using Shamir's Secret Sharing, recombine the given shares into the original data
     * @param document The document to unseal
     * @param membersWithPrivateKey Members with loaded private keys
     * @returns The unsealed data
     * @throws {SealingError} If validation fails or unsealing fails
     */
    brightTrustUnseal<T>(document: BrightTrustDataRecord<TID>, membersWithPrivateKey: Member<TID>[]): Promise<T>;
    /**
     * Using Shamir's Secret Sharing, recombine the given shares into the original data
     * @param document The document to unseal
     * @param recoveredShares The shares to use for unsealing
     * @returns The unsealed data
     * @throws {SealingError} If validation fails or unsealing fails
     */
    brightTrustUnsealWithShares<T>(document: BrightTrustDataRecord<TID>, recoveredShares: Shares): Promise<T>;
    /**
     * Encrypt each key share with each member's public key
     * @param shares The shares to encrypt
     * @param members The members to encrypt shares for
     * @returns Map of encrypted shares by member ID
     * @throws {SealingError} If validation fails or encryption fails
     */
    encryptSharesForMembers(shares: Shares, members: Member<TID>[]): Promise<Map<HexString, Uint8Array>>;
    /**
     * Decrypt each key share with each member's private key
     * @param encryptedSharesByMemberId Map of encrypted shares by member ID
     * @param members Members with loaded private keys
     * @returns Decrypted shares
     * @throws {SealingError} If validation fails or decryption fails
     */
    decryptSharesForMembers(encryptedSharesByMemberId: Map<TID, Uint8Array>, members: Member<TID>[]): Promise<Shares>;
    /**
     * Split a hex-encoded secret into Shamir shares.
     * Initializes the secrets library for bootstrap mode (allows 1 share minimum).
     *
     * @param secretHex - The hex-encoded secret to split
     * @param totalShares - Total number of shares to generate
     * @param threshold - Minimum shares needed to reconstruct
     * @returns Array of hex-encoded share strings
     */
    shamirSplit(secretHex: string, totalShares: number, threshold: number): string[];
    /**
     * Combine Shamir shares to reconstruct the original hex-encoded secret.
     * Initializes the secrets library for bootstrap mode (allows 1 share minimum).
     *
     * @param shares - Array of hex-encoded share strings
     * @param totalShareCount - Total number of shares that were originally generated (for reinit)
     * @returns The reconstructed hex-encoded secret
     */
    shamirCombine(shares: string[], totalShareCount: number): string;
}
//# sourceMappingURL=sealing.service.d.ts.map