import * as x509 from "@peculiar/x509";
import { SigningKey } from "@authhero/adapter-interfaces";
/**
 * Supported signing-key shapes. Note: `EC-P-521` is not supported on
 * Cloudflare Workers (`workerd`) — `crypto.subtle.generateKey` will reject
 * `{ name: "ECDSA", namedCurve: "P-521" }` there. Callers running on Workers
 * must pick `RSA`, `EC-P-256`, or `EC-P-384`.
 */
export type SigningKeyType = "RSA" | "EC-P-256" | "EC-P-384" | "EC-P-521";
export interface CreateX509CertificateParams {
    name: string;
    /**
     * The key type to generate. Defaults to "RSA" (RS256-compatible) for
     * backwards compatibility with existing tenants.
     */
    keyType?: SigningKeyType;
}
export declare function createX509Certificate(params: CreateX509CertificateParams): Promise<SigningKey>;
export declare function convertPKCS7ToPem(keyType: "PRIVATE" | "PUBLIC", binaryData: ArrayBuffer): string;
export declare function toJWKS(key: CryptoKey): Promise<JsonWebKey>;
export declare function getJWKThumbprint(cert: x509.X509Certificate): Promise<string>;
export declare function computeJWKThumbprint(jwk: JsonWebKey): Promise<string>;
