export interface AssertAscAccessOptions {
    keyId: string;
    issuerId: string;
    /** The decoded .p8 PEM string (forge.util.decode64(APPLE_KEY_CONTENT)). */
    p8Pem: string;
    /** Project bundle id; when present we confirm it is reachable by the key. */
    bundleId?: string;
    signal?: AbortSignal;
    /** Per-request timeout. Defaults to 7s (under the engine's 10s race). */
    timeoutMs?: number;
    /** Test-only injection point. Defaults to globalThis.fetch. */
    fetchImpl?: typeof fetch;
}
interface AscProviderFailure {
    /** Apple HTTP status and sanitized structured error fields, when available. */
    status?: number;
    code?: string;
    title?: string;
    detail?: string;
}
export type AscAccessResult = {
    ok: true;
} | ({
    ok: false;
    kind: 'no-app-access' | 'auth-error' | 'network';
    message: string;
} & AscProviderFailure);
/**
 * Probe App Store Connect for app access. Never throws - every failure shape is
 * returned as `{ ok: false, kind }` so the prescan check can self-classify the
 * severity from the HTTP status and sanitized Apple reason. Network failures
 * remain distinguishable so prescan can surface them as warnings.
 */
export declare function assertAscAccess(opts: AssertAscAccessOptions): Promise<AscAccessResult>;
export {};