/**
 * AES-256-GCM image encryption for Convos per-conversation profiles.
 *
 * Matches the iOS implementation in ConvosProfiles/Crypto/ImageEncryption.swift:
 * - HKDF-SHA256 to derive a per-image key from the group key + random salt
 * - AES-256-GCM encryption with random nonce
 * - Ciphertext format: encrypted data + 16-byte GCM auth tag (nonce stripped)
 *
 * Each group has a 32-byte encryption key stored in
 * ConversationCustomMetadata.imageEncryptionKey (appData field 4).
 */
export interface EncryptedPayload {
    /** AES-GCM ciphertext with appended auth tag (nonce NOT prepended) */
    ciphertext: Uint8Array;
    /** 32-byte HKDF salt for key derivation */
    salt: Uint8Array;
    /** 12-byte AES-GCM nonce */
    nonce: Uint8Array;
}
/**
 * Generate a new 32-byte AES-256 group key.
 */
export declare function generateGroupKey(): Uint8Array;
/**
 * Encrypt image data using AES-256-GCM.
 *
 * @param imageData - Plaintext image data (JPEG, PNG, etc.)
 * @param groupKey - 32-byte group encryption key
 * @returns Encrypted payload with ciphertext, salt, and nonce
 */
export declare function encryptImage(imageData: Uint8Array, groupKey: Uint8Array): Promise<EncryptedPayload>;
/**
 * Decrypt ciphertext using AES-256-GCM.
 *
 * @param ciphertext - Encrypted data with appended auth tag (no nonce prefix)
 * @param groupKey - 32-byte group encryption key
 * @param salt - 32-byte HKDF salt used during encryption
 * @param nonce - 12-byte AES-GCM nonce used during encryption
 * @returns Decrypted plaintext image data
 */
export declare function decryptImage(ciphertext: Uint8Array, groupKey: Uint8Array, salt: Uint8Array, nonce: Uint8Array): Promise<Uint8Array>;
/**
 * Download image data from a URL.
 */
export declare function fetchImageData(url: string): Promise<Uint8Array>;
/**
 * Conversation-like object — just the fields needed for image encryption key management.
 */
interface ConversationLike {
    sync(): Promise<void>;
    appData: string | undefined;
    updateAppData(data: string): Promise<void>;
}
interface EncryptAndUploadLogger {
    log?: (message: string) => void;
    verboseLog?: (message: string) => void;
}
/**
 * Download an image URL, encrypt it with the conversation's group key, and upload
 * the encrypted blob. Returns an EncryptedProfileImageRef ready for a ProfileUpdate.
 *
 * This is the shared implementation used by create, join, update-profile, and agent/serve.
 *
 * @param imageUrl - URL of the image to encrypt
 * @param conversation - Group conversation (used to read/write the encryption key in appData)
 * @param uploadFn - Upload function: (data, filename, mimeType) => URL
 * @param logger - Optional log/verboseLog callbacks for progress output
 * @returns EncryptedProfileImageRef with url, salt, and nonce
 */
export declare function encryptAndUploadProfileImage(imageUrl: string, conversation: ConversationLike, uploadFn: (data: Uint8Array, filename: string, mimeType: string) => Promise<string>, logger?: EncryptAndUploadLogger): Promise<{
    url: string;
    salt: Uint8Array;
    nonce: Uint8Array;
}>;
export {};