/**
 * Group key derivation and envelope encryption for CANARY sync.
 *
 * All functions are zero-dependency and use only the Web Crypto API (crypto.subtle)
 * together with the pure-JS primitives in ./crypto.ts.
 */
import type { Persona } from 'nsec-tree/persona';
import type { Identity } from 'nsec-tree/core';
/**
 * Derive a 32-byte symmetric group key from a seed.
 *
 * `HMAC-SHA256(hex_to_bytes(seed), utf8("canary:sync:key"))`
 *
 * @param seedHex - Group seed as a 64-character lowercase hex string (32 bytes).
 * @returns 32-byte AES-256 group key for envelope encryption.
 * @throws {Error} If seedHex is not a valid 64-character hex string.
 */
export declare function deriveGroupKey(seedHex: string): Uint8Array;
/**
 * Encrypt a plaintext string with AES-256-GCM using the provided group key.
 *
 * Returns `base64(IV || ciphertext || auth_tag)` where IV is a random 12-byte nonce.
 *
 * @param groupKey - 32-byte AES-256 key from {@link deriveGroupKey}.
 * @param plaintext - UTF-8 string to encrypt.
 * @returns Base64-encoded ciphertext (12-byte IV prepended to AES-GCM output).
 * @throws {Error} If groupKey is not 32 bytes.
 */
export declare function encryptEnvelope(groupKey: Uint8Array, plaintext: string): Promise<string>;
/**
 * Decrypt an envelope produced by `encryptEnvelope`.
 *
 * Expects `base64(IV || ciphertext || auth_tag)`.
 * Throws on authentication failure (wrong key or tampered data).
 *
 * @param groupKey - 32-byte AES-256 key from {@link deriveGroupKey}.
 * @param encoded - Base64-encoded ciphertext from {@link encryptEnvelope}.
 * @returns Decrypted plaintext string.
 * @throws {Error} If groupKey is not 32 bytes, data is too short, or decryption fails.
 */
export declare function decryptEnvelope(groupKey: Uint8Array, encoded: string): Promise<string>;
/**
 * Derive a group signing identity from a persona.
 *
 * Uses nsec-tree's two-level derivation: persona → group.
 * Purpose string: `canary:group:{groupId}`
 * Index maps to group epoch — reseed increments epoch, producing fresh keys for all members.
 *
 * @param persona - The member's persona (from nsec-tree derivePersona).
 * @param groupId - The group identifier string.
 * @param epoch - Group epoch (0 = initial, increments on reseed).
 * @returns nsec-tree Identity with signing key for this group.
 */
export declare function deriveGroupIdentity(persona: Persona, groupId: string, epoch: number): Identity;
export type { Persona, Identity };
/**
 * Hash a group ID to produce a privacy-preserving public tag.
 *
 * `hex(SHA256(utf8(groupId)))` — returns a 64-character lowercase hex string.
 *
 * Publishing the hash rather than the group ID prevents observers from
 * correlating events to a known group name.
 *
 * @param groupId - The group identifier string.
 * @returns 64-character lowercase hex string (SHA-256 hash of the group ID).
 */
export declare function hashGroupTag(groupId: string): string;
//# sourceMappingURL=sync-crypto.d.ts.map