/**
 * Encrypted Backup and Restore (RCV-3)
 *
 * Exports and imports encrypted identity and cryptographic state.
 * Uses PBKDF2 (NIST SP 800-132) for key derivation and AES-256-GCM
 * for authenticated encryption.
 *
 * @module backup
 */
import type { Result } from '@private.me/shared';
import type { AgentIdentity } from './identity.js';
/**
 * Encrypted backup blob containing identity and state.
 *
 * Format:
 * - version: 1 (future compatibility)
 * - salt: 16-byte random salt for PBKDF2
 * - iv: 12-byte random IV for AES-256-GCM
 * - ciphertext: AES-256-GCM encrypted backup data
 * - tag: 16-byte GCM authentication tag
 */
export interface EncryptedBackup {
    /**
     * Backup format version for future compatibility.
     */
    readonly version: 1;
    /**
     * PBKDF2 salt (base64-encoded 16 bytes).
     */
    readonly salt: string;
    /**
     * AES-256-GCM IV (base64-encoded 12 bytes).
     */
    readonly iv: string;
    /**
     * AES-256-GCM ciphertext (base64-encoded encrypted backup).
     */
    readonly ciphertext: string;
    /**
     * AES-256-GCM authentication tag (base64-encoded 16 bytes).
     */
    readonly tag: string;
}
/**
 * Error codes for backup/restore operations.
 */
export type BackupError = 'INVALID_PASSWORD' | 'EXPORT_FAILED' | 'IMPORT_FAILED' | 'ENCRYPTION_FAILED' | 'DECRYPTION_FAILED' | 'INVALID_BACKUP' | 'PBKDF2_FAILED' | 'CRYPTO_NOT_SUPPORTED';
/**
 * Export an identity as an encrypted backup blob.
 *
 * Encrypts the complete identity (Ed25519, X25519, ML-KEM, ML-DSA keys,
 * rotated keys) with a password using PBKDF2 + AES-256-GCM.
 *
 * The backup can be stored safely in cloud storage, version control, or
 * transmitted over untrusted channels. Only the password holder can decrypt.
 *
 * Security:
 * - PBKDF2-SHA256 with 310,000 iterations (≈100ms on modern hardware)
 * - AES-256-GCM for authenticated encryption
 * - Random salt + IV for each backup (no two backups are identical)
 * - 16-byte GCM tag prevents tampering
 *
 * @param identity - Agent identity to backup.
 * @param password - User password (plaintext). Will be PBKDF2 derived.
 * @returns Encrypted backup blob or error.
 *
 * @example
 * ```typescript
 * import { generateIdentity } from '@private.me/xbind';
 * import { exportBackup } from '@private.me/xbind';
 *
 * const identity = await generateIdentity();
 * if (!identity.ok) throw identity.error;
 *
 * const backup = await exportBackup(identity.value, 'user-password');
 * if (!backup.ok) throw backup.error;
 *
 * // Store backup securely
 * const json = JSON.stringify(backup.value);
 * localStorage.setItem('backup', json);
 * ```
 */
export declare function exportBackup(identity: AgentIdentity, password: string): Promise<Result<EncryptedBackup, BackupError>>;
/**
 * Restore an identity from an encrypted backup blob.
 *
 * Decrypts the backup using PBKDF2-derived AES key. Verifies authenticity
 * with GCM tag before returning plaintext keys.
 *
 * @param backup - Encrypted backup blob.
 * @param password - User password (plaintext). Will be PBKDF2 derived.
 * @returns Restored AgentIdentity or error.
 *
 * @example
 * ```typescript
 * import { importBackup } from '@private.me/xbind';
 *
 * const json = localStorage.getItem('backup');
 * const backup = JSON.parse(json);
 *
 * const identity = await importBackup(backup, 'user-password');
 * if (!identity.ok) {
 *   if (identity.error === 'INVALID_PASSWORD') {
 *     console.error('Wrong password!');
 *   } else {
 *     throw identity.error;
 *   }
 * }
 *
 * // Now use restored identity
 * const agent = new Agent(identity.value);
 * ```
 */
export declare function importBackup(backup: EncryptedBackup, password: string): Promise<Result<AgentIdentity, BackupError>>;
