export interface VaultConfig {
    orgPubKey: Uint8Array;
    kid: string;
    orgPepper: Uint8Array;
    tenantId: string;
}
export interface VaultConfigFields {
    org_id: string;
    kid: string;
    alg: string;
    org_pub: string;
    pepper: string;
    not_before: string;
    expires_at: string | null;
    epoch: number;
}
export interface SignedVaultConfig extends VaultConfigFields {
    sign_pub: string;
    signature: string;
}
export declare function canonicalConfigPayload(c: VaultConfigFields): string;
export declare function signConfig(fields: VaultConfigFields, signPrivPkcs8: Uint8Array): Promise<string>;
export declare function verifyConfig(signed: SignedVaultConfig, pinnedSignPub: Uint8Array): Promise<boolean>;
export declare function resolveVaultConfig(signed: SignedVaultConfig, pinnedSignPub: Uint8Array, tenantId: string, now: number, lastEpoch?: number): Promise<VaultConfig | null>;