import { Algorithm } from 'jsonwebtoken';

/**
 * @spfn/auth - Client Crypto Helpers
 *
 * ES256 (ECDSA P-256) key generation and JWT signing for Next.js
 * Keys are stored in DER format (Base64 encoded) for efficiency
 *
 * Key Sizes:
 * - ES256 (ECDSA P-256): ~91 bytes (Base64: ~120 chars)
 * - RS256 (RSA 2048):   ~294 bytes (Base64: ~392 chars)
 */

type Unit = "Years" | "Year" | "Yrs" | "Yr" | "Y" | "Weeks" | "Week" | "W" | "Days" | "Day" | "D" | "Hours" | "Hour" | "Hrs" | "Hr" | "H" | "Minutes" | "Minute" | "Mins" | "Min" | "M" | "Seconds" | "Second" | "Secs" | "Sec" | "s" | "Milliseconds" | "Millisecond" | "Msecs" | "Msec" | "Ms";
type UnitAnyCase = Unit | Uppercase<Unit> | Lowercase<Unit>;
type StringValue = `${number}` | `${number}${UnitAnyCase}` | `${number} ${UnitAnyCase}`;
interface KeyPair {
    privateKey: string;
    publicKey: string;
    keyId: string;
    fingerprint: string;
    algorithm: 'ES256' | 'RS256';
}
interface TokenPayload {
    userId?: string;
    keyId?: string;
    timestamp?: number;
    exp?: number;
    iat?: number;
    iss?: string;
    [key: string]: any;
}
/**
 * Generate ECDSA P-256 key pair (ES256)
 * Recommended for optimal size and performance
 */
declare function generateKeyPairES256(): KeyPair;
/**
 * Generate RSA 2048 key pair (RS256)
 * Fallback option, larger size but wider compatibility
 */
declare function generateKeyPairRS256(): KeyPair;
/**
 * Generate key pair (defaults to ES256)
 */
declare function generateKeyPair(algorithm?: 'ES256' | 'RS256'): KeyPair;
/**
 * Generate JWT signed with client private key (DER format)
 */
declare function generateClientToken(payload: Record<string, any>, privateKeyB64: string, algorithm: Algorithm, options?: {
    expiresIn?: StringValue | number;
    issuer?: string;
}): string;
/**
 * Verify JWT with public key (DER format)
 *
 * @internal Used for testing/validation only
 * For production verification, use server-side verifyClientToken
 */
declare function verifyClientToken(token: string, publicKeyB64: string, algorithm: 'ES256' | 'RS256'): TokenPayload;
/**
 * Get key size information
 */
declare function getKeySize(publicKeyB64: string): {
    bytes: number;
    base64Length: number;
};
/**
 * Check if key should be rotated based on creation date
 */
declare function shouldRotateKey(createdAt: Date, rotationDays?: number): {
    shouldRotate: boolean;
    daysRemaining: number;
};

export { type KeyPair, type TokenPayload, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, getKeySize, shouldRotateKey, verifyClientToken };
