import { Address } from 'viem';
/**
 * Which of the two legitimate on-chain candidates a role's hint matched.
 *
 * Both true means the role never rotated, so the hint constrains nothing.
 * Both false means the hint is not explainable by any state the chain is in.
 */
export interface HintMatch {
    registration: boolean;
    operation: boolean;
}
/**
 * The accept-either policy itself.
 *
 * Kept as a named function rather than inlined at each call site so that
 * changing the policy is a one-line change in one file, and so a reader can
 * find every path governed by it.
 */
export declare function isHintAccepted(match: HintMatch): boolean;
/** Match a single hinted key against both candidates. */
export declare function matchKeyHint(hint: string, registrationKey: string, operationKey: string): HintMatch;
/**
 * Match a hinted key *set* against both candidate sets.
 *
 * Compared as whole sets, never as per-element membership of the union: a
 * roster holding one registration key and one operation key is an indexer that
 * is halfway through applying a rotation, and union membership would wave that
 * through. Order is normalized, so this is set equality and not list equality.
 */
export declare function matchKeySetHint(hints: readonly string[], registrationKeys: readonly string[], operationKeys: readonly string[]): HintMatch;
export interface AssertVaultProviderHintAcceptedParams {
    /** Vault provider's admin address, named in the error. */
    vaultProviderEthAddress: Address;
    /** The untrusted hint. Absent means there is nothing to cross-check. */
    hintBtcPubkey?: string;
    /** The vault provider's registration key, already read from chain. */
    registrationBtcPubkey: string;
    /**
     * Reads the vault provider's *current* operation key.
     *
     * Invoked only when the hint fails against the registration key, so a
     * provider that never rotated — and an indexer that has not caught up — cost
     * no extra RPC. Callers must not pre-read this.
     */
    readCurrentOperationBtcPubkey: () => Promise<string>;
    /**
     * Sentence appended to the error naming what was aborted, e.g.
     * `"Aborting refund."`. The shared half of the message says which keys
     * failed to match; this says which operation the user just lost.
     */
    context?: string;
}
/**
 * Assert an indexer-hinted vault provider key is one the chain can explain.
 *
 * Resolves silently when there is no hint, or when the hint matches either
 * candidate. Throws otherwise — the caller's key material is unaffected either
 * way, since resolution is chain-only.
 */
export declare function assertVaultProviderHintAccepted(params: AssertVaultProviderHintAcceptedParams): Promise<void>;
//# sourceMappingURL=indexerKeyHint.d.ts.map