/**
 * XorIDA Backup Configuration for Key Splitting
 *
 * Provides default backup configuration (k=2, n=3) and utilities for
 * splitting cryptographic keys across multiple shares using information-
 * theoretic threshold secret sharing.
 *
 * @module backup-config
 */
import type { Result } from '@private.me/shared';
/**
 * Configuration for XorIDA backup key splitting.
 *
 * Threshold sharing requires k shares to reconstruct the original key.
 * Total n shares are generated - up to n-k can be lost without data loss.
 */
export interface BackupConfig {
    /**
     * Threshold: minimum number of shares required for reconstruction.
     *
     * Default: 2 (any 2 shares can reconstruct)
     */
    readonly threshold: number;
    /**
     * Total shares: number of shares to generate.
     *
     * Default: 3 (3 shares generated, lose 1 and still recover)
     */
    readonly totalShares: number;
}
/**
 * A single backup share containing key data and metadata.
 */
export interface BackupShare {
    /**
     * Share index (0-based).
     */
    readonly index: number;
    /**
     * Share data (base64-encoded).
     */
    readonly data: string;
    /**
     * Total shares in the set.
     */
    readonly total: number;
    /**
     * Threshold required for reconstruction.
     */
    readonly threshold: number;
    /**
     * HMAC key for integrity verification (base64).
     */
    readonly hmacKey: string;
    /**
     * HMAC signature (base64).
     */
    readonly hmacSig: string;
}
/**
 * Error codes for backup operations.
 */
export type BackupError = 'INVALID_CONFIG' | 'INVALID_KEY_LENGTH' | 'SPLIT_FAILED' | 'RECONSTRUCT_FAILED' | 'HMAC_VERIFICATION_FAILED' | 'INSUFFICIENT_SHARES' | 'INVALID_SHARE_DATA';
/**
 * Default backup configuration: 2-of-3 threshold sharing.
 *
 * - 3 shares generated
 * - Any 2 shares can reconstruct the key
 * - Lose 1 share and still recover (fault tolerance)
 * - Information-theoretic security (each share reveals zero information)
 */
export declare const DEFAULT_BACKUP_CONFIG: BackupConfig;
/**
 * Validate backup configuration parameters.
 *
 * Rules:
 * - threshold must be >= 2 (single share = no threshold)
 * - totalShares must be >= threshold
 * - totalShares must be <= 255 (XorIDA limit)
 *
 * @param config - Backup configuration to validate.
 * @returns Ok if valid, error otherwise.
 */
export declare function validateBackupConfig(config: BackupConfig): Result<void, BackupError>;
/**
 * Split a cryptographic key into backup shares using XorIDA.
 *
 * The key is padded, split via information-theoretic threshold sharing,
 * and returned as BackupShare objects with HMAC integrity protection.
 *
 * Any `threshold` shares can reconstruct the original key. Each share
 * reveals zero information about the key (information-theoretic security).
 *
 * @param key - The key to split (32 or 64 bytes typical).
 * @param config - Backup configuration (defaults to 2-of-3).
 * @returns Array of backup shares or error.
 *
 * @example
 * ```typescript
 * import { splitKeyWithBackup, DEFAULT_BACKUP_CONFIG } from '@private.me/xbind';
 *
 * const key = crypto.getRandomValues(new Uint8Array(32));
 *
 * // Use defaults (2-of-3)
 * const shares = await splitKeyWithBackup(key);
 *
 * // Custom config (3-of-5)
 * const shares2 = await splitKeyWithBackup(key, {
 *   threshold: 3,
 *   totalShares: 5
 * });
 *
 * if (shares.ok) {
 *   // Store shares in separate locations
 *   shares.value.forEach((share, i) => {
 *     storeShare(`backup-${i}.json`, JSON.stringify(share));
 *   });
 * }
 * ```
 */
export declare function splitKeyWithBackup(key: Uint8Array, config?: BackupConfig): Promise<Result<BackupShare[], BackupError>>;
/**
 * Reconstruct a cryptographic key from backup shares.
 *
 * Requires at least `threshold` shares. Verifies HMAC before returning
 * the reconstructed key to prevent tampering.
 *
 * @param shares - Backup shares (must be >= threshold).
 * @returns Reconstructed key or error.
 *
 * @example
 * ```typescript
 * import { reconstructKeyFromBackup } from '@private.me/xbind';
 *
 * // Load shares from storage
 * const share0 = JSON.parse(loadShare('backup-0.json'));
 * const share1 = JSON.parse(loadShare('backup-1.json'));
 *
 * // Reconstruct from any 2 shares (threshold=2)
 * const key = await reconstructKeyFromBackup([share0, share1]);
 *
 * if (key.ok) {
 *   // Use reconstructed key
 *   const agent = await Agent.fromSeed(key.value, opts);
 * } else {
 *   console.error('Reconstruction failed:', key.error);
 * }
 * ```
 */
export declare function reconstructKeyFromBackup(shares: BackupShare[]): Promise<Result<Uint8Array, BackupError>>;
