import { OlmMachine } from "@ixo/matrix-sdk-crypto-nodejs";
import * as AsyncLock from "async-lock";
import { MatrixClient } from "../MatrixClient";
/**
 * Structure of an exported room key that can be imported into the OlmMachine.
 */
export interface ExportedRoomKey {
    algorithm: string;
    room_id: string;
    sender_key: string;
    session_id: string;
    session_key: string;
    sender_claimed_keys: Record<string, string>;
    forwarding_curve25519_key_chain: string[];
}
/**
 * Information about a key backup version from the server.
 */
export interface KeyBackupInfo {
    algorithm: string;
    auth_data: {
        public_key: string;
        signatures?: Record<string, Record<string, string>>;
    };
    version: string;
    count?: number;
    etag?: string;
}
/**
 * Trust information for a key backup.
 */
export interface BackupTrustInfo {
    /** Whether we have a matching decryption key stored */
    matchesDecryptionKey: boolean;
    /** Whether the backup is signed by a trusted key */
    trusted: boolean;
}
/**
 * Result of a key backup restore operation.
 */
export interface KeyBackupRestoreResult {
    total: number;
    imported: number;
}
/**
 * Session data structure in a key backup.
 */
export interface KeyBackupSessionData {
    first_message_index: number;
    forwarded_count: number;
    is_verified: boolean;
    session_data: {
        ephemeral: string;
        ciphertext: string;
        mac: string;
    };
}
/**
 * Manages key backup operations for the Matrix crypto client.
 *
 * This class handles:
 * - Checking and enabling server-side key backup
 * - Continuous background upload of room keys to the backup
 * - Key recovery from backup (with limitations - see restoreKeyBackup)
 *
 * @category Encryption
 */
export declare class BackupManager {
    private readonly machine;
    private readonly client;
    private readonly lock;
    private activeBackupVersion;
    private backupLoopRunning;
    private stopped;
    private decryptionKey;
    private readonly recoveryKeyBase64?;
    /** In Memory Cache of session IDs confirmed missing from backup — avoids repeated HTTP lookups */
    private readonly missingSessionCache;
    /**
     * Creates a new BackupManager.
     * @param machine The OlmMachine instance for crypto operations
     * @param client The MatrixClient for API requests
     * @param recoveryKey Optional recovery key for backup decryption.
     *   Supports both formats:
     *   - Base58 (human-readable): "EsTc LW2K PGiF wKEA 3As5 g5c4 BXwk qeeJ ZJV8 Q9fu gUMN UE4d"
     *   - Base64 (internal): "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo="
     */
    constructor(machine: OlmMachine, client: MatrixClient, recoveryKey: string | undefined, lock: AsyncLock);
    /**
     * Decode a recovery key from Base58 format to Base64.
     * Handles both Base58 (with spaces) and Base64 formats.
     *
     * Base58 format: "EsTc LW2K PGiF wKEA 3As5 g5c4 BXwk qeeJ ZJV8 Q9fu gUMN UE4d"
     * Base64 format: "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo="
     *
     * @param recoveryKey The recovery key in either format
     * @returns The recovery key in Base64 format
     */
    static decodeRecoveryKey(recoveryKey: string): string;
    /**
     * Stop the backup manager and cancel any pending operations.
     */
    stop(): void;
    /**
     * Get the currently active backup version, if any.
     */
    getActiveBackupVersion(): Promise<string | null>;
    /**
     * Check the server for a key backup and enable it if trusted.
     *
     * This method:
     * 1. Fetches the current backup version from the server
     * 2. Verifies the backup is trusted (either signed or matches our decryption key)
     * 3. Enables key backup if trusted
     * 4. Starts the background key upload loop
     *
     * @returns The backup info and trust status, or null if no backup exists
     */
    checkKeyBackupAndEnable(): Promise<{
        backupInfo: KeyBackupInfo;
        trustInfo: BackupTrustInfo;
    } | null>;
    /**
     * Determine if a key backup can be trusted.
     *
     * @param info The key backup info from the server
     * @returns Trust information
     */
    isKeyBackupTrusted(info: KeyBackupInfo): Promise<BackupTrustInfo>;
    /**
     * Enable key backup with the given backup info.
     */
    private enableKeyBackup;
    /**
     * Disable key backup.
     */
    private disableKeyBackup;
    /**
     * Create a new backup version on the server using the configured recovery key.
     */
    private createBackupVersion;
    /**
     * Trigger a check for keys to upload. Call this after receiving new keys.
     */
    maybeUploadKey(): Promise<void>;
    /**
     * Background loop that continuously uploads room keys to the backup.
     *
     * This loop:
     * 1. Gets batches of keys from the OlmMachine
     * 2. Uploads them to the server
     * 3. Marks them as sent
     * 4. Repeats until no more keys need backup
     */
    private backupKeysLoop;
    /**
     * Get the current backup version info from the server.
     *
     * @param version Optional specific version to fetch
     * @returns The backup info or null if no backup exists
     */
    requestKeyBackupVersion(version?: string): Promise<KeyBackupInfo | null>;
    /**
     * Download all backed up keys from the server.
     *
     * @param backupVersion The backup version to download from
     * @returns The backed up keys organized by room and session
     */
    downloadKeyBackup(backupVersion: string): Promise<{
        rooms: Record<string, {
            sessions: Record<string, KeyBackupSessionData>;
        }>;
    }>;
    /**
     * Download a specific session key from the backup.
     *
     * @param backupVersion The backup version
     * @param roomId The room ID
     * @param sessionId The session ID
     * @returns The session data or null if not found
     */
    downloadSessionKey(backupVersion: string, roomId: string, sessionId: string): Promise<KeyBackupSessionData | null>;
    /**
     * Decrypt a session from the backup.
     *
     * @param sessionData The encrypted session data
     * @returns The decrypted session data as a JSON object
     */
    decryptSession(sessionData: KeyBackupSessionData): Record<string, unknown>;
    /**
     * Restore keys from backup.
     *
     * Downloads all backed up keys, decrypts them, and imports them into the OlmMachine.
     *
     * @param backupVersion Optional version to restore from (defaults to active version)
     * @returns The count of total and imported keys
     */
    restoreKeyBackup(backupVersion?: string): Promise<KeyBackupRestoreResult>;
    /**
     * Restore all keys for a single room from backup.
     *
     * Downloads the backed up keys for the given room, decrypts them, and imports
     * them into the OlmMachine. Used before building an MSC4268 room key bundle so
     * that the bundle covers keys this device may have missed.
     *
     * @param roomId The room ID to restore keys for.
     * @returns The count of total and imported keys.
     */
    importRoomKeysFromBackup(roomId: string): Promise<KeyBackupRestoreResult>;
    /**
     * Import a single session key from backup.
     *
     * Downloads and imports a specific session key - useful for on-demand key recovery
     * when decryption fails due to a missing key.
     *
     * @param roomId The room ID
     * @param sessionId The session ID
     * @returns True if the key was successfully imported
     */
    importSessionKeyFromBackup(roomId: string, sessionId: string): Promise<boolean>;
    /**
     * Get the current room key counts.
     */
    getRoomKeyCounts(): Promise<{
        total: number;
        backedUp: number;
    }>;
    /**
     * Check if key backup is currently enabled.
     */
    isBackupEnabled(): Promise<boolean>;
    private sleep;
}