/**
 * CAP-DB-backed private-state provider for the Midnight JS SDK.
 *
 * Replaces `@midnight-ntwrk/midnight-js-level-private-state-provider` for
 * production use. The SDK's LevelDB provider has an explicit JSDoc warning
 * against production use ("clearing local files permanently destroys the
 * private state", no recovery path). This implementation persists into
 * NIGHTGATE's CAP DB (SQLite dev / HANA prod) with the same AES-256-GCM
 * encryption format the SDK uses for its export blobs.
 *
 * Wire-format compatibility: an export produced here is importable by the
 * SDK's LevelDB provider and vice versa. See srv/utils/storage-encryption.ts.
 *
 * Scope: instance is bound to a single `accountId` (a wallet identifier such
 * as the wallet address). All set/get/remove operations are also scoped to
 * the `currentContractAddress` set via `setContractAddress()` per the SDK
 * interface contract.
 */
type ContractAddress = string;
type PrivateStateId = string;
type SigningKey = string;
interface PrivateStateExport {
    readonly format: 'midnight-private-state-export';
    readonly encryptedPayload: string;
    readonly salt: string;
}
interface SigningKeyExport {
    readonly format: 'midnight-signing-key-export';
    readonly encryptedPayload: string;
    readonly salt: string;
}
interface ExportPrivateStatesOptions {
    readonly password?: string;
    readonly maxStates?: number;
}
interface ImportPrivateStatesOptions {
    readonly password?: string;
    readonly conflictStrategy?: 'skip' | 'overwrite' | 'error';
    readonly maxStates?: number;
}
interface ImportPrivateStatesResult {
    readonly imported: number;
    readonly skipped: number;
    readonly overwritten: number;
}
interface ExportSigningKeysOptions {
    readonly password?: string;
    readonly maxKeys?: number;
}
interface ImportSigningKeysOptions {
    readonly password?: string;
    readonly conflictStrategy?: 'skip' | 'overwrite' | 'error';
    readonly maxKeys?: number;
}
interface ImportSigningKeysResult {
    readonly imported: number;
    readonly skipped: number;
    readonly overwritten: number;
}
export declare class ExportDecryptionError extends Error {
    constructor();
}
export declare class InvalidExportFormatError extends Error {
    constructor(msg: string);
}
export declare class ImportConflictError extends Error {
    constructor(conflictCount: number);
}
export interface CapDbPrivateStateProviderConfig {
    accountId: string;
    privateStoragePasswordProvider: () => Promise<string> | string;
    /**
     * Optional db handle. Defaults to `cds.connect.to('db')` on first use.
     * Injecting a handle is useful for tests.
     */
    db?: any;
}
export declare class CapDbPrivateStateProvider<PSI extends PrivateStateId = PrivateStateId, PS = any> {
    private readonly config;
    private currentContractAddress;
    private db;
    private encryptionPromise;
    constructor(config: CapDbPrivateStateProviderConfig);
    setContractAddress(address: ContractAddress): void;
    set(privateStateId: PSI, state: PS): Promise<void>;
    get(privateStateId: PSI): Promise<PS | null>;
    remove(privateStateId: PSI): Promise<void>;
    clear(): Promise<void>;
    setSigningKey(address: ContractAddress, signingKey: SigningKey): Promise<void>;
    getSigningKey(address: ContractAddress): Promise<SigningKey | null>;
    removeSigningKey(address: ContractAddress): Promise<void>;
    clearSigningKeys(): Promise<void>;
    exportPrivateStates(options?: ExportPrivateStatesOptions): Promise<PrivateStateExport>;
    importPrivateStates(exportData: PrivateStateExport, options?: ImportPrivateStatesOptions): Promise<ImportPrivateStatesResult>;
    exportSigningKeys(options?: ExportSigningKeysOptions): Promise<SigningKeyExport>;
    importSigningKeys(exportData: SigningKeyExport, options?: ImportSigningKeysOptions): Promise<ImportSigningKeysResult>;
    private requireContractAddress;
    private getDb;
    private getStoragePassword;
    /**
     * Memoized per-instance StorageEncryption.
     *
     * The salt is DETERMINISTIC per (account, password) rather than random.
     * This is essential for cross-instance reads: each submission builds its
     * own provider instance, so a deploy that writes private state and a later
     * call that reads it use DIFFERENT instances. With a random per-instance
     * salt, the reader's `decrypt()` rejected the writer's blob with
     * "Salt mismatch" (the ledger never even saw it — it failed in our storage
     * layer). A deterministic salt makes every instance for the same account
     * derive the same key, so reads succeed across instances while keeping the
     * one-PBKDF2-per-instance optimization and the integrity salt-check.
     *
     * The password is already a high-entropy per-account secret (derived from
     * the wallet viewing key), so deriving the salt from it does not weaken the
     * anti-precomputation property. Export blobs still get their own fresh
     * random salt (see exportPrivateStates/exportSigningKeys).
     */
    private getEncryption;
    /** Deterministic 32-byte salt for this account's internal storage. */
    private deriveStableSalt;
    private upsertPrivateState;
    private upsertSigningKey;
}
export {};
