/**
 * @file encryption.ts
 * @description AES-256-GCM content encryption for private Inkd uploads,
 *              plus Lit Protocol integration stub for token-gated encryption.
 *              V1 uses passthrough (no encryption). V2 will use Lit Protocol
 *              so only the InkdToken owner can decrypt inscribed data.
 */
import type { EncryptionConfig, EncryptedData, Address } from "./types";
/**
 * Encrypt content with AES-256-GCM using a wallet private key.
 * Wire format: [4B iv-len][iv][4B tag-len][tag][ciphertext]
 *
 * @param data - Raw content to encrypt
 * @param privateKey - EVM wallet private key (hex, with or without 0x prefix)
 * @returns Encrypted buffer ready for Arweave upload
 */
export declare function encryptForWallet(data: Buffer, privateKey: string): Buffer;
/**
 * Decrypt content encrypted by `encryptForWallet`.
 *
 * @param data - Encrypted buffer from Arweave
 * @param privateKey - EVM wallet private key
 * @returns Decrypted content buffer
 */
export declare function decryptForWallet(data: Buffer, privateKey: string): Buffer;
/**
 * Encryption provider interface.
 * V1 uses passthrough. V2 will use Lit Protocol.
 */
export interface IEncryptionProvider {
    /** Encrypt data before upload. */
    encrypt(data: Uint8Array, tokenId: bigint, contractAddress: Address): Promise<EncryptedData>;
    /** Decrypt data after download. Only works if caller holds the token. */
    decrypt(encryptedData: EncryptedData, tokenId: bigint, contractAddress: Address): Promise<Uint8Array>;
}
/**
 * V1 passthrough encryption — data is stored unencrypted.
 * Swappable with LitEncryptionProvider in V2.
 */
export declare class PassthroughEncryption implements IEncryptionProvider {
    encrypt(data: Uint8Array, _tokenId: bigint, _contractAddress: Address): Promise<EncryptedData>;
    decrypt(encryptedData: EncryptedData, _tokenId: bigint, _contractAddress: Address): Promise<Uint8Array>;
}
/**
 * Lit Protocol encryption provider (V2).
 * Encrypts data so only the ERC-721 InkdToken owner can decrypt it.
 *
 * @example
 * ```ts
 * const encryption = new LitEncryptionProvider({ network: "datil", chain: "base" });
 * await encryption.connect();
 *
 * const encrypted = await encryption.encryptForToken(data, tokenId);
 * const decrypted = await encryption.decryptWithToken(encrypted, tokenId);
 * ```
 */
export declare class LitEncryptionProvider implements IEncryptionProvider {
    private config;
    private connected;
    constructor(config: EncryptionConfig);
    /** Connect to the Lit Protocol network. */
    connect(): Promise<void>;
    /** Encrypt data for a specific InkdToken. Only the token owner can decrypt. */
    encryptForToken(data: Uint8Array, tokenId: bigint, contractAddress?: Address): Promise<EncryptedData>;
    /** Decrypt data using InkdToken ownership proof. */
    decryptWithToken(encryptedData: EncryptedData, tokenId: bigint, contractAddress?: Address): Promise<Uint8Array>;
    encrypt(_data: Uint8Array, _tokenId: bigint, _contractAddress: Address): Promise<EncryptedData>;
    decrypt(_encryptedData: EncryptedData, _tokenId: bigint, _contractAddress: Address): Promise<Uint8Array>;
}
//# sourceMappingURL=encryption.d.ts.map