import { type KeyObject } from "crypto";
export interface ServerIdentity {
    /** Raw X25519 public key, base64url, 43 chars. Public: the QR, /api/info, logs. */
    publicKey: string;
    /** Never leaves the process — not a log line, not a response, not an error message. */
    privateKey: KeyObject;
}
/**
 * `~/.threadbase/keys/server-identity.key`.
 *
 * Its own file, not a `server.yaml` key: that file is parsed by single-line
 * regex and users are invited to hand-edit it, which is no place for a private
 * key. The config dir is resolved per call, and inlined rather than imported
 * from auth.ts, matching runtime-store.ts / pty-host/socket.ts /
 * codexGateAnswers.ts — tests redirect it with THREADBASE_CONFIG_DIR.
 */
export declare function serverIdentityKeyPath(): string;
/**
 * The server identity, generated on first call and stable forever after —
 * across restarts and across API-key rotation.
 *
 * Stability is the whole point. The public half goes into a pair QR, so minting
 * a second key would silently invalidate every device that scanned the first.
 * A file that exists but cannot be read therefore **throws** rather than
 * regenerating: losing this key must be a deliberate act (delete the file), not
 * the recovery path for a bad read.
 */
export declare function loadOrCreateServerIdentity(): ServerIdentity;
/** The public half alone, for callers that must never hold the private key. */
export declare function serverIdentityPublicKey(): string;
/**
 * The fingerprint a user compares out of band (design.md §2.2): SHA-256 over
 * the raw 32 public-key bytes, truncated to the first 16, printed as 8
 * space-separated groups of 4 lowercase hex characters.
 *
 * Pure function of the base64url string `serverIdentityPublicKey()` returns —
 * decode that, not the JWK or any other encoding, or this hashes different
 * bytes than the phone does and the two fingerprints never match.
 */
export declare function serverIdentityFingerprint(publicKeyBase64url: string): string;
/** Convenience over the real, on-disk identity key. */
export declare function currentServerIdentityFingerprint(): string;
//# sourceMappingURL=server-identity.d.ts.map