/**
 * Sync protocol — types, code generation, and encryption helpers.
 *
 * Used by both the drawlatch remote server and the callboard sync client
 * to coordinate a double-code key exchange with AES-256-GCM encryption.
 */
import type { SerializedPublicKeys } from '../crypto/keys.js';
/**
 * Generate a human-readable sync code: WORD-NNNN (e.g., "WOLF-3847").
 */
export declare function generateSyncCode(): string;
/**
 * Generate a one-time AES-256-GCM key for encrypting the sync exchange.
 * Returns a base64-encoded 32-byte key.
 */
export declare function generateSyncEncryptionKey(): string;
/**
 * Encrypt a JSON-serializable payload with AES-256-GCM.
 *
 * Wire format: base64(IV[12] || authTag[16] || ciphertext)
 */
export declare function encryptSyncPayload(payload: object, encryptionKey: string): string;
/**
 * Decrypt an AES-256-GCM encrypted payload back to a parsed object.
 *
 * Throws on decryption failure (wrong key, tampered data, etc.).
 */
export declare function decryptSyncPayload(encrypted: string, encryptionKey: string): unknown;
/** Sent by callboard to drawlatch (encrypted with sync encryption key). */
export interface SyncRequest {
    inviteCode: string;
    confirmCode: string;
    callerAlias: string;
    publicKeys: SerializedPublicKeys;
}
/** Returned by drawlatch to callboard (encrypted with sync encryption key). */
export interface SyncResponse {
    remotePublicKeys: SerializedPublicKeys;
    callerAlias: string;
    fingerprint: string;
}
/** Maximum number of failed sync code attempts before session invalidation. */
export declare const MAX_SYNC_ATTEMPTS = 5;
/** Server-side sync session state. */
export interface SyncSession {
    inviteCode: string;
    confirmCode: string | null;
    encryptionKey: string;
    createdAt: number;
    ttlMs: number;
    completed: boolean;
    /** Number of failed code-match attempts (session invalidated at MAX_SYNC_ATTEMPTS). */
    failedAttempts: number;
    /** Populated after successful sync. */
    result?: {
        callerAlias: string;
        fingerprint: string;
    };
}
export type SyncErrorCode = 'NO_ACTIVE_SESSION' | 'CODE_MISMATCH' | 'SESSION_EXPIRED' | 'ALREADY_COMPLETED' | 'DECRYPTION_FAILED' | 'INVALID_PAYLOAD';
export declare const DEFAULT_SYNC_TTL_MS: number;
/**
 * Check whether a sync session is still valid (not expired and not completed).
 */
export declare function isSyncSessionActive(session: SyncSession): boolean;
/**
 * Validate a SyncRequest shape (after decryption).
 * Returns null if valid, or an error message string.
 */
export declare function validateSyncRequest(data: unknown): string | null;
//# sourceMappingURL=sync.d.ts.map