/**
 * Whitepaper §2.1 / §4.4 — Encrypted Documents and docHash.
 *
 * ECIES: ECDH (secp256k1) + HKDF-SHA256 + configurable AEAD (default: aes-256-gcm) + SHA3-256(docHash).
 * The holder's public key (secp256k1 compressed hex) and payload are used
 * to derive a shared key, encrypt the JSON payload, and produce docHash/CID.
 */
import type { LemmaClient } from "@lemmaoracle/spec";
/**
 * Derive the compressed secp256k1 public key from a private key.
 *
 * Accepts a 32-byte hex string with or without `0x` prefix.
 * Returns a 33-byte compressed public key as a hex string (no `0x` prefix).
 */
export declare const derivePublicKey: (privateKey: string) => string;
export type EncryptionAlgorithm = "aes-256-gcm";
export type EncryptInput = Readonly<{
    payload: unknown;
    holderKey: string;
    algorithm?: EncryptionAlgorithm;
}>;
export type EncryptOutput = Readonly<{
    docHash: string;
    cid: string;
    ciphertext: string;
    algorithm: EncryptionAlgorithm;
}>;
export type DecryptInput = Readonly<{
    ciphertext: string;
    holderPrivateKey: string;
    algorithm?: EncryptionAlgorithm;
}>;
export type DecryptOutput = Readonly<{
    payload: unknown;
}>;
/**
 * Encrypt a JSON payload to a holder's secp256k1 public key (ECIES).
 *
 * Generates a fresh ephemeral keypair per call (CSPRNG) and derives the
 * shared encryption key via ECDH + HKDF-SHA256, then seals the payload
 * with AES-256-GCM. This function performs no network I/O; it is a local
 * cryptographic operation but is non-deterministic due to the ephemeral
 * keypair and random nonce. The `_client` parameter is accepted for
 * forward-compatibility of the public signature and is not read; it is
 * retained so future versions may add client-bound behavior without a
 * breaking change.
 *
 * Whitepaper §2.1 / §4.4.
 */
export declare const encrypt: (_client: LemmaClient, input: EncryptInput) => Promise<EncryptOutput>;
export declare const decrypt: (input: DecryptInput) => Promise<DecryptOutput>;
//# sourceMappingURL=crypto.d.ts.map