export type GeneratedKeyPair = {
    readonly privateKeyPem: string;
    readonly publicKeyPem: string;
    readonly kid: string;
};
export type SigningScope = {
    readonly org: string;
    readonly project: string;
};
export type SigningPayload = {
    readonly appId: string;
    readonly version: string;
    readonly bundleSha256: string;
    readonly role: 'developer' | 'certifier';
    readonly scopes: readonly SigningScope[];
    readonly iat: number;
    /**
     * @deprecated Dev and certifier signatures are independent by design.
     * The certifier does not embed a reference to the developer signature.
     * This field will be removed in a future release.
     */
    readonly devSignatureSha256?: string;
};
export type SigningResult = {
    readonly token: string;
    readonly kid: string;
    readonly payload: SigningPayload;
};
export type VerificationResult = {
    readonly payload: SigningPayload;
    readonly kid: string;
};
export type SignOptions = {
    readonly privateKeyPem: string;
    readonly kid: string;
    readonly appId: string;
    readonly version: string;
    readonly bundleStream: ReadableStream<Uint8Array>;
    readonly role: 'developer' | 'certifier';
    readonly scopes: readonly SigningScope[];
    /**
     * @deprecated Dev and certifier signatures are independent by design.
     * Pass the SHA-256 hex of the developer's compact token to embed it in the certifier payload.
     * This option will be removed in a future release.
     */
    readonly devSignatureSha256?: string;
};
export type VerifyOptions = {
    readonly publicKeyPem: string;
    readonly token: string;
    readonly bundleStream: ReadableStream<Uint8Array>;
};