/**
 * Persistent seal configuration (stored in .aegis/.seal-config.json).
 * Tracks threshold, total share count, and a key hash for verification.
 * Never stores the master key or shares.
 */
export interface SealConfig {
    /** Minimum shares required to reconstruct the master key. */
    threshold: number;
    /** Total shares that were generated. */
    totalShares: number;
    /** SHA-256 hash of the master key (hex) — used to verify reconstruction. */
    keyHash: string;
    /** ISO timestamp of when key splitting was configured. */
    createdAt: string;
}
/**
 * Manages vault seal state — key splitting configuration, unseal key
 * storage, and sealed/unsealed transitions.
 *
 * Modelled after HashiCorp Vault's seal/unseal mechanism, adapted for
 * CLI (non-daemon) usage: the reconstructed key is persisted to a
 * restricted file instead of held in memory.
 *
 * Files managed:
 *   .aegis/.seal-config.json  — threshold, share count, key hash
 *   .aegis/.unseal-key        — reconstructed master key (mode 0600)
 */
export declare class SealManager {
    private dataDir;
    private configPath;
    private unsealKeyPath;
    constructor(dataDir: string);
    /**
     * Enable key splitting — stores threshold, share count, and a SHA-256
     * hash of the master key for post-reconstruction verification.
     */
    enableSplit(threshold: number, totalShares: number, masterKey: string): void;
    /** Read seal configuration, or null if key splitting is not configured. */
    getSealConfig(): SealConfig | null;
    /** Whether key splitting has been configured for this deployment. */
    isSplitEnabled(): boolean;
    /**
     * Verify a reconstructed master key against the stored hash.
     * Uses timing-safe comparison to prevent side-channel leaks.
     */
    verifyKey(masterKey: string): boolean;
    /**
     * Write the reconstructed master key to the unseal key file.
     * File is created with mode 0600 (owner read/write only).
     */
    writeUnsealKey(masterKey: string): void;
    /** Read the unseal key, or null if the vault is sealed. */
    readUnsealKey(): string | null;
    /** Whether the vault is currently unsealed (unseal key file exists). */
    isUnsealed(): boolean;
    /**
     * Seal the vault — securely remove the unseal key file.
     * Overwrites the file with zeros before unlinking (defense in depth
     * against filesystem journal recovery).
     */
    seal(): void;
    /**
     * Remove seal configuration entirely — reverts to standard master key mode.
     * Also removes any existing unseal key.
     */
    removeSealConfig(): void;
}
//# sourceMappingURL=seal.d.ts.map