/** Ethereum address for a secp256k1 private key (for pinning / tests / the backend mock). */
export declare function addressFromPrivateKey(privateKeyHex: string): string;
/** Sign claims into a recoverable-secp256k1 JWS. */
export declare function signJws(claims: Record<string, unknown>, privateKeyHex: string): string;
export interface VerifiedJws {
    claims: Record<string, unknown>;
    /** Recovered signer Ethereum address (lowercase 0x-hex). */
    signerAddress: string;
}
/**
 * Verify the signature and recover the signer address. Throws on a malformed
 * or unverifiable token — it does NOT check claims (exp, bindings); that is
 * verifyApproval()'s job. Pure: no clock, no network.
 */
export declare function verifyJws(token: string): VerifiedJws;