/**
 * TAP-specific validation rules.
 *
 * These rules are enforced here (NOT in http-signatures):
 * - 8-minute window: expires - created <= 480
 * - Time validation: created <= now <= expires
 * - Tag allowlist: fail-closed by default
 * - Algorithm: ed25519 required
 */
import type { ParsedSignatureParams } from '@peac/http-signatures';
import { type TapTag } from './types.js';
/**
 * Validate TAP-specific time constraints.
 *
 * @param params - Parsed signature parameters
 * @param now - Current Unix timestamp
 * @throws TapError if validation fails
 */
export declare function validateTapTimeConstraints(params: ParsedSignatureParams, now: number): void;
/**
 * Validate TAP algorithm.
 *
 * @param alg - Algorithm from signature params
 * @throws TapError if algorithm is not ed25519
 */
export declare function validateTapAlgorithm(alg: string): void;
/**
 * Validate TAP tag.
 *
 * @param tag - Tag from signature params
 * @param allowUnknownTags - Whether to allow unknown tags
 * @throws TapError if tag is unknown and allowUnknownTags is false
 */
export declare function validateTapTag(tag: string | undefined, allowUnknownTags: boolean): void;
/**
 * Check if a tag is a known TAP tag.
 */
export declare function isKnownTapTag(tag: string): tag is TapTag;
//# sourceMappingURL=validator.d.ts.map