import type { MurasakiConfig } from '../config.js';
export interface ResolvedWindowsSigningOptions {
    signToolPath?: string;
    certificateFile?: string;
    certificateSubjectName?: string;
    certificateSha1?: string;
    certificatePassword?: string;
    certificateStore: 'currentUser' | 'localMachine';
    timestampUrl: string | false;
    artifactSigning?: {
        dlib: string;
        metadata: string;
    };
    allowUntrustedCiCertificate: boolean;
}
/**
 * Resolve Windows signing without ever persisting credentials. Environment
 * variables override project config so CI can select a certificate/provider
 * without editing a release checkout.
 */
export declare function resolveWindowsSigningOptions(config: MurasakiConfig, cwd?: string, env?: NodeJS.ProcessEnv): ResolvedWindowsSigningOptions;
/** Build the exact SignTool `sign` arguments. Exported for regression tests. */
export declare function windowsSignArgs(artifactPath: string, productName: string, options: ResolvedWindowsSigningOptions): string[];
/** Build Authenticode-policy verification arguments. */
export declare function windowsVerifyArgs(artifactPath: string, options: Pick<ResolvedWindowsSigningOptions, 'timestampUrl'>): string[];
/** Sign and then independently verify one PE/MSI artifact. */
export declare function signWindowsArtifact(artifactPath: string, config: MurasakiConfig, cwd?: string): void;
//# sourceMappingURL=windows-signing.d.ts.map