export interface AssertAscAccessOptions {
    keyId: string;
    issuerId: string;
    /** The decoded .p8 PEM string (forge.util.decode64(APPLE_KEY_CONTENT)). */
    p8Pem: string;
    /** Project bundle id; when present we confirm it is reachable by the key. */
    bundleId?: string;
    signal?: AbortSignal;
    /** Per-request timeout. Defaults to 7s (under the engine's 10s race). */
    timeoutMs?: number;
    /** Test-only injection point. Defaults to globalThis.fetch. */
    fetchImpl?: typeof fetch;
}
export type AscAccessResult = {
    ok: true;
} | {
    ok: false;
    kind: 'no-app-access' | 'auth-error' | 'network';
    message: string;
};
/**
 * Probe App Store Connect for app access. Never throws - every failure shape is
 * returned as `{ ok: false, kind }` so the prescan check can self-classify the
 * severity (auth-error -> error, no-app-access -> error, network -> info).
 */
export declare function assertAscAccess(opts: AssertAscAccessOptions): Promise<AscAccessResult>;