export interface SigningMaterial {
    /** The Pass Type ID certificate, PEM or DER. */
    certificate: Buffer | string;
    /** Its private key, PEM or DER. */
    privateKey: Buffer | string;
    /** The passphrase, if the key is encrypted. */
    passphrase?: string;
    /**
     * Everything between the signing certificate and the root.
     *
     * For a real pass that is Apple's WWDR intermediate. The device already trusts
     * the root and will not fetch what it is not given, so omitting this produces
     * a signature that verifies in isolation and is refused on a phone — which is
     * exactly the class of failure this package exists to catch earlier.
     */
    intermediates?: readonly (Buffer | string)[];
}
export interface SignOptions {
    /**
     * The moment recorded in the signature.
     *
     * Injected rather than read from the clock so a build can be made
     * byte-reproducible — which is what lets the golden-file tests assert on a
     * whole archive instead of on the parts that happen to be stable.
     */
    signedAt?: Date;
}
/**
 * Signs `content`, returning a detached CMS SignedData in DER.
 *
 * Detached: the signature carries a digest of the content and not the content
 * itself, because the content is already in the archive as `manifest.json`.
 */
export declare function signDetached(content: Uint8Array, material: SigningMaterial, options?: SignOptions): Promise<Buffer>;
export interface SignatureVerdict {
    verified: boolean;
    /** Why not, in words, when it did not verify. */
    reason?: string;
    /** The certificate that signed it, as a subject line. */
    signer?: string;
}
/**
 * Verifies a detached signature over `content`, optionally against a trust anchor.
 *
 * Two questions, and they are separate. Without `trustedRoots` this answers only
 * "were these bytes signed by the key in this container" — which is what a test
 * with a generated certificate wants. With them it also answers "does that key
 * chain to somebody we trust", which is the question a real pass has to pass and
 * the one a self-signed certificate fails.
 */
export declare function verifyDetached(signature: Uint8Array, content: Uint8Array, trustedRoots?: readonly (Buffer | string)[]): Promise<SignatureVerdict>;
//# sourceMappingURL=sign.d.ts.map