/**
 * Minimal CBOR encoder for the server-identity payload shape.
 *
 * We only need to encode one specific CBOR structure — the 3-tuple
 * `(SERVER_IDENTITY_DOMAIN, ephemeral_pubkey_bytes, expires_at_u64)` —
 * byte-for-byte identical to what the Rust `ciborium` crate produces
 * for the corresponding tuple, because that's the exact message the
 * VP signs with BIP-322.
 *
 * IMPORTANT encoding quirk: the Rust side passes the domain and
 * pubkey as `&[u8]` / `Vec<u8>` without a `#[serde(with = "serde_bytes")]`
 * attribute, so serde/ciborium encodes them as **CBOR arrays of u8**
 * (major type 4, one item per byte) — NOT as CBOR byte strings (major
 * type 2). A naive byte-string encoding would produce the wrong bytes
 * and signature verification would fail.
 *
 * Rather than pull in a full CBOR dependency for this one shape, we
 * implement the exact subset inline (~40 LOC) and pin it with golden
 * vectors against the Rust reference output.
 *
 * @module tbv/core/clients/vault-provider/auth/cbor
 */
/**
 * Encode the server-identity payload the Rust side signs:
 *
 *     ciborium::into_writer(
 *       &(SERVER_IDENTITY_DOMAIN, ephemeral_pubkey.serialize().to_vec(), expires_at),
 *       buf
 *     )
 *
 * Output bytes are byte-for-byte identical to the Rust reference,
 * pinned by the golden vector in the corresponding test file.
 *
 * @internal Exposed only for the golden-vector test that pins this
 * encoding against ciborium's output. Production callers reach this
 * via `verifyServerIdentity` from `./serverIdentity`.
 *
 * @param domain - Must be `"btc-auth.server-identity.v1"` (27 bytes)
 *                 — the constant from btc-vault's `server_identity.rs`.
 * @param ephemeralPubkeyCompressed - 33-byte SEC1-compressed pubkey.
 * @param expiresAt - Unix timestamp (seconds). Must be a safe integer.
 */
export declare function encodeServerIdentityPayload(domain: Uint8Array, ephemeralPubkeyCompressed: Uint8Array, expiresAt: number): Uint8Array;
//# sourceMappingURL=cbor.d.ts.map