/**
 * SDK-compatible storage encryption for private state and signing key blobs.
 *
 * Implements the EXACT wire format used by the Midnight JS SDK's LevelDB
 * private-state provider so that exports produced by NIGHTGATE's CAP-DB
 * provider can be imported by the SDK's LevelDB provider, and vice versa.
 *
 * Wire format of an encrypted payload (base64-decoded):
 *
 *   [ 1 byte  version    = 2          ]
 *   [ 32 bytes salt      (PBKDF2)     ]
 *   [ 12 bytes IV        (GCM nonce)  ]
 *   [ 16 bytes authTag   (GCM tag)    ]
 *   [ N bytes  ciphertext (AES-256-GCM) ]
 *
 * Key derivation: PBKDF2-SHA256(password, salt, 600_000, 32 bytes).
 *
 * For internal CAP-DB storage we use a memoized per-account master key
 * (one PBKDF2 per session, not per row), the SDK's LevelDB provider does
 * the same. Export blobs always include their own salt and re-derive,
 * preserving cross-compat.
 */
export declare const ALGORITHM = "aes-256-gcm";
export declare const KEY_LENGTH = 32;
export declare const IV_LENGTH = 12;
export declare const AUTH_TAG_LENGTH = 16;
export declare const SALT_LENGTH = 32;
export declare const PBKDF2_ITERATIONS_V2 = 600000;
export declare const ENCRYPTION_VERSION_V2 = 2;
export declare const CURRENT_ENCRYPTION_VERSION = 2;
/**
 * Mirrors the SDK's StorageEncryption class for byte-compatibility.
 * One instance ↔ one (password, salt) pair.
 */
export declare class StorageEncryption {
    readonly salt: Buffer;
    private readonly encryptionKey;
    constructor(password: string, existingSalt?: Buffer);
    /** Encrypts `data` (UTF-8 string) and returns base64-encoded SDK wire format. */
    encrypt(data: string): string;
    /**
     * Decrypts an SDK-format base64 payload. The salt in the payload must match
     * this instance's salt (i.e. the same password was used).
     */
    decrypt(encryptedData: string): string;
}
export declare function deriveKey(password: string, salt: Buffer): Buffer;
export interface EncryptedComponents {
    version: number;
    salt: Buffer;
    iv: Buffer;
    authTag: Buffer;
    encrypted: Buffer;
}
export declare function extractEncryptedComponents(data: Buffer): EncryptedComponents;
/**
 * Decrypts an SDK-format base64 payload given a password. Re-derives the key
 * from the salt embedded in the payload. Used for import where we don't yet
 * know the salt.
 */
export declare function decryptWithPassword(encryptedData: string, password: string): string;
