import type { KeyLike } from 'node:crypto';

export function signReferenceCandidate(
  candidate: Readonly<Record<string, unknown>>,
  signer: { keyId: string; privateKey: KeyLike },
): Record<string, unknown>;
export function verifySignedReferenceRun(
  run: Readonly<Record<string, unknown>>,
  policy: { schema: string; keyId: string; publicKeyPem: string },
): Record<string, unknown>;