import type { TrustAnchorBundle, TrustAnchor } from './types.js';
export interface BuildBundleInput {
    bundle_id: string;
    anchors: TrustAnchor[];
    issued_at: number;
    refresh_after: number;
    revoked_anchors?: string[];
}
export declare function buildBundle(input: BuildBundleInput, publisher_pubkey_hex: string): Omit<TrustAnchorBundle, 'signature_b64'>;
export declare function signBundle(unsigned: Omit<TrustAnchorBundle, 'signature_b64'>, publisher_sk_hex: string): TrustAnchorBundle;
export type BundleVerifyReason = 'signature_invalid' | 'untrusted_publisher' | 'bundle_expired' | 'not_yet_valid';
export interface BundleVerifyOutcome {
    ok: boolean;
    reason?: BundleVerifyReason;
}
/** Verify a bundle's signature and freshness. The verifier supplies
 *  a root-trusted publisher key list; the bundle MUST be signed by
 *  one of them, not merely self-signed. */
export declare function verifyBundle(bundle: TrustAnchorBundle, trusted_publisher_pubkeys_hex: string[], now_ms: number): BundleVerifyOutcome;
//# sourceMappingURL=trust-bundle.d.ts.map