/**
 * Encrypted location beacons and duress alerts for canary groups.
 *
 * Key derivation: sync (HMAC-SHA256 from crypto.ts)
 * Encryption:     async (AES-256-GCM via crypto.subtle)
 *
 * The sync/async split is intentional:
 * - Word derivation stays sync (called frequently, deterministic)
 * - Beacon/duress encryption is async (event-driven, one call per publish)
 */
/**
 * Derive a 256-bit AES key from the group seed for beacon encryption.
 * Deterministic: same seed always produces the same key.
 *
 * @param seedHex - Group seed as a 64-character lowercase hex string (32 bytes).
 * @returns 32-byte AES-256 key derived via HMAC-SHA256.
 * @throws {Error} If seedHex is not a valid 64-character hex string.
 */
export declare function deriveBeaconKey(seedHex: string): Uint8Array;
/**
 * Derive a 256-bit AES key from the group seed for duress alert encryption.
 * Uses a distinct HMAC info string from beacon keys for domain separation —
 * prevents cross-type key reuse between normal beacons and duress alerts.
 *
 * @param seedHex - Group seed as a 64-character lowercase hex string (32 bytes).
 * @returns 32-byte AES-256 key derived via HMAC-SHA256 with duress-specific info.
 * @throws {Error} If seedHex is not a valid 64-character hex string.
 */
export declare function deriveDuressKey(seedHex: string): Uint8Array;
/** Decrypted content of an encrypted location beacon (kind 20078 signal). */
export interface BeaconPayload {
    geohash: string;
    precision: number;
    timestamp: number;
}
/**
 * Encrypt a location beacon payload with the group's beacon key.
 * Returns a base64 string suitable for a Nostr event's `content` field.
 *
 * @param key - 32-byte AES-256 key from {@link deriveBeaconKey}.
 * @param geohash - Geohash string representing the location.
 * @param precision - Geohash precision level (1-11).
 * @returns Base64-encoded ciphertext (12-byte IV prepended to AES-GCM output).
 * @throws {Error} If key is not 32 bytes.
 */
export declare function encryptBeacon(key: Uint8Array, geohash: string, precision: number): Promise<string>;
/**
 * Decrypt a location beacon event's content.
 * Throws if the key is wrong or the ciphertext is tampered with (AES-GCM authentication).
 *
 * @param key - 32-byte AES-256 key from {@link deriveBeaconKey}.
 * @param content - Base64-encoded ciphertext from the beacon event's content field.
 * @returns Decrypted {@link BeaconPayload} with geohash, precision, and timestamp.
 * @throws {Error} If decryption fails, ciphertext is tampered, or payload is malformed.
 */
export declare function decryptBeacon(key: Uint8Array, content: string): Promise<BeaconPayload>;
/** Duress propagation scope. */
export type DuressScope = 'group' | 'persona' | 'master';
/** Decrypted content of a duress alert beacon (kind 20078 signal, AES-GCM encrypted). */
export interface DuressAlert {
    type: 'duress';
    member: string;
    geohash: string;
    precision: number;
    locationSource: 'beacon' | 'verifier' | 'none';
    timestamp: number;
    /** Propagation scope: group (default), persona (all groups in category), or master (everything). */
    scope: DuressScope;
    /** The group that originally triggered the duress alert. Present when scope is persona or master. */
    originGroupId?: string;
}
/** Location info for a duress alert. Null means no location available. */
export interface DuressLocation {
    geohash: string;
    precision: number;
    locationSource: 'beacon' | 'verifier';
}
/**
 * Construct a duress alert payload.
 *
 * The caller is responsible for geohash encoding and precision upgrade
 * (e.g. using geohash-kit to re-encode at precision 11 for duress).
 * This function just assembles the payload.
 *
 * @param memberPubkey - 64-character lowercase hex pubkey of the member under duress.
 * @param location - Location info with geohash, precision, and source; or null if unavailable.
 * @param options - Optional scope and originGroupId for propagation control.
 * @returns A {@link DuressAlert} payload ready for encryption.
 * @throws {Error} If memberPubkey is not a valid 64-character hex string.
 */
export declare function buildDuressAlert(memberPubkey: string, location: DuressLocation | null, options?: {
    scope?: DuressScope;
    originGroupId?: string;
}): DuressAlert;
/**
 * Encrypt a duress alert with the group's duress key (from deriveDuressKey).
 * Returns a base64 string for the Nostr event's `content` field.
 *
 * @param key - 32-byte AES-256 key from {@link deriveDuressKey}.
 * @param alert - The {@link DuressAlert} payload to encrypt.
 * @returns Base64-encoded ciphertext (12-byte IV prepended to AES-GCM output).
 * @throws {Error} If key is not 32 bytes.
 */
export declare function encryptDuressAlert(key: Uint8Array, alert: DuressAlert): Promise<string>;
/**
 * Decrypt a duress alert event's content.
 *
 * @param key - 32-byte AES-256 key from {@link deriveDuressKey}.
 * @param content - Base64-encoded ciphertext from the duress alert event's content field.
 * @returns Decrypted {@link DuressAlert} payload.
 * @throws {Error} If decryption fails, ciphertext is tampered, or payload is malformed.
 */
export declare function decryptDuressAlert(key: Uint8Array, content: string): Promise<DuressAlert>;
//# sourceMappingURL=beacon.d.ts.map