/**
 * @file crypto.ts
 * @description Content encryption for private Inkd projects.
 *
 * Flow for private projects:
 *   1. Generate random AES-256-GCM content key
 *   2. Encrypt content with that key
 *   3. Wrap the AES key with ECIES for each authorized wallet
 *   4. Build access manifest (stored on Arweave, hash on-chain)
 *
 * Encryption: AES-256-GCM for content + ECIES (secp256k1) for key wrapping
 * Binary layout (ECIES wrapped key):
 *   [33 bytes] ephemeral compressed public key
 *   [12 bytes] AES-GCM IV
 *   [16 bytes] AES-GCM auth tag
 *   [32 bytes] encrypted AES key
 */
import type { Address } from 'viem';
export interface EncryptedContent {
    /** base64-encoded encrypted content */
    ciphertext: string;
    /** base64-encoded IV (12 bytes) */
    iv: string;
    /** base64-encoded auth tag (16 bytes) */
    tag: string;
}
export declare function generateContentKey(): Buffer;
export declare function encryptContent(data: Buffer, key: Buffer): EncryptedContent;
export declare function decryptContent(encrypted: EncryptedContent, key: Buffer): Buffer;
export interface WrappedKey {
    /** Compressed secp256k1 public key of recipient (hex) */
    recipientPublicKey: string;
    /** base64-encoded ECIES-wrapped AES key */
    wrappedKey: string;
}
/**
 * Wrap an AES key for a recipient's compressed public key.
 * Returns base64-encoded blob: ephemeralPubKey(33) | iv(12) | tag(16) | encryptedKey(32)
 */
export declare function wrapKey(aesKey: Buffer, recipientCompressedPubKey: string): string;
/**
 * Unwrap an ECIES-wrapped AES key using the recipient's private key.
 */
export declare function unwrapKey(wrappedKeyB64: string, recipientPrivKeyHex: string): Buffer;
/**
 * Derive compressed secp256k1 public key from a private key.
 */
export declare function privateKeyToCompressedPublicKey(privateKeyHex: string): string;
export interface AccessManifestRecipient {
    address: Address;
    publicKey: string;
    wrappedKey: string;
}
export interface AccessManifest {
    schema: 'inkd/access-manifest/v1';
    projectId: number;
    algorithm: 'aes-256-gcm+ecies-secp256k1';
    contentKey: {
        recipients: AccessManifestRecipient[];
    };
    createdAt: string;
    updatedAt: string;
}
export declare function buildAccessManifest(projectId: number, aesKey: Buffer, recipients: Array<{
    address: Address;
    compressedPublicKey: string;
}>): AccessManifest;
/**
 * Add a new recipient to an existing access manifest (given the owner's private key to unwrap).
 */
export declare function addRecipientToManifest(manifest: AccessManifest, ownerPrivateKeyHex: string, newRecipient: {
    address: Address;
    compressedPublicKey: string;
}): AccessManifest;
//# sourceMappingURL=crypto.d.ts.map