import { SigningKey, KeysAdapter } from "@authhero/adapter-interfaces";
import { SigningKeyMode, SigningKeyModeOption } from "../types/AuthHeroConfig";
export declare function resolveSigningKeyMode(option: SigningKeyModeOption | undefined, tenantId: string): Promise<SigningKeyMode>;
export interface ResolveSigningKeysOptions {
    /**
     * `"sign"` returns at most one key — the tenant's newest non-revoked key
     * if available, else the control-plane fallback. `"publish"` returns the
     * full set used for JWKS: control-plane only when mode is
     * `"control-plane"`, tenant ∪ control-plane when mode is `"tenant"` so
     * tokens signed by either bucket still verify during rotation.
     */
    purpose: "sign" | "publish";
    /** Defaults to `"jwt_signing"`. Pass `"saml_encryption"` for SAML keys. */
    type?: string;
}
export declare function resolveSigningKeys(keys: KeysAdapter, tenantId: string, modeOption: SigningKeyModeOption | undefined, opts: ResolveSigningKeysOptions): Promise<SigningKey[]>;
