/**
 * Server-identity verification for the vault provider's
 * `auth_createDepositorToken` response.
 *
 * The VP returns a `ServerIdentityResponse` bundled with every issued
 * token:
 *
 *   - `server_pubkey`:    VP's persistent x-only pubkey (HEX, 32B)
 *   - `ephemeral_pubkey`: VP's ephemeral token-signing key (HEX, 33B compressed)
 *   - `expires_at`:       Unix timestamp when the ephemeral key expires
 *   - `signature`:        BIP-322 signature by the persistent key over
 *                         `(SERVER_IDENTITY_DOMAIN, ephemeral_pubkey, expires_at)`
 *
 * The FE pins `server_pubkey` against the on-chain `VaultProvider.btcPubKey`
 * it reads from the registry contract. A mismatch rejects the token.
 *
 * @module tbv/core/clients/vault-provider/auth/serverIdentity
 */
/**
 * Wire representation from btc-vault's `ServerIdentityResponse`.
 */
export interface ServerIdentityResponse {
    /** Hex-encoded x-only (32-byte) persistent server pubkey. */
    server_pubkey: string;
    /** Hex-encoded compressed (33-byte) ephemeral token-signing pubkey. */
    ephemeral_pubkey: string;
    /** Unix timestamp at which the ephemeral key expires. */
    expires_at: number;
    /** Hex-encoded 64-byte BIP-322 Schnorr signature. */
    signature: string;
}
export interface VerifyServerIdentityInput {
    /** The proof returned by `auth_createDepositorToken`. */
    proof: ServerIdentityResponse;
    /**
     * The x-only persistent server pubkey the FE expects (sourced from
     * the on-chain `VaultProvider.btcPubKey` via the vault registry
     * reader). 64-char lowercase hex, no `0x` prefix.
     */
    pinnedServerPubkey: string;
    /** Current Unix timestamp in seconds. Injected for testability. */
    now: number;
    /** Cap on `proof.expires_at - now` (seconds). Defaults to {@link DEFAULT_MAX_PROOF_LIFETIME_SECS}. */
    maxLifetimeSecs?: number;
}
export declare class ServerIdentityError extends Error {
    readonly reason: "pinned_pubkey_mismatch" | "expired" | "expires_too_far" | "invalid_expires_at" | "invalid_max_lifetime" | "invalid_pubkey_encoding" | "invalid_ephemeral_pubkey" | "invalid_signature_encoding" | "signature_verification_failed";
    constructor(message: string, reason: "pinned_pubkey_mismatch" | "expired" | "expires_too_far" | "invalid_expires_at" | "invalid_max_lifetime" | "invalid_pubkey_encoding" | "invalid_ephemeral_pubkey" | "invalid_signature_encoding" | "signature_verification_failed");
}
/**
 * Verify a server identity proof against a pinned server pubkey.
 *
 * Checks:
 *   1. `server_pubkey` matches the pin.
 *   2. `now < expires_at <= now + maxLifetimeSecs` (with integer guards).
 *   3. `ephemeral_pubkey` is a well-formed 33-byte compressed pubkey.
 *   4. `signature` is a well-formed 64-byte Schnorr hex string.
 *   5. The BIP-322 Schnorr signature cryptographically verifies
 *      against `server_pubkey` over the CBOR-encoded tuple
 *      `(SERVER_IDENTITY_DOMAIN, ephemeral_pubkey, expires_at)`.
 *
 * Step 5 is what actually binds the ephemeral key to the persistent
 * pubkey — without it, a TLS-MITM attacker who reads the pinned
 * pubkey from the on-chain registry could substitute an arbitrary
 * ephemeral pubkey paired with any lexically-valid signature.
 *
 * @throws ServerIdentityError on any validation failure.
 */
export declare function verifyServerIdentity(input: VerifyServerIdentityInput): void;
//# sourceMappingURL=serverIdentity.d.ts.map