import { DataAdapters } from "@authhero/adapter-interfaces";
import { SigningKeyModeOption } from "../types/AuthHeroConfig";
/**
 * Helper function to fetch JWKS keys from the database for token *verification*.
 *
 * Returns every non-revoked `jwt_signing` key regardless of tenant scope so a
 * token signed by any key (control-plane or any tenant) can be matched by kid.
 * Use `getJwksForPublication` for the public `/.well-known/jwks.json` endpoint.
 */
export declare function getJwksFromDatabase(data: DataAdapters): Promise<{
    alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
    kid: string;
    kty: "RSA" | "EC" | "oct";
    use?: "sig" | "enc" | undefined;
    n?: string | undefined;
    e?: string | undefined;
    crv?: string | undefined;
    x?: string | undefined;
    y?: string | undefined;
    x5t?: string | undefined;
    x5c?: string[] | undefined;
}[]>;
/**
 * JWKS for publication on a tenant's `/.well-known/jwks.json`. Honors the
 * configured `signingKeyMode` and, in `"tenant"` mode, returns the union of
 * the tenant's keys and the control-plane fallback so tokens signed by either
 * still verify during the per-tenant key rollout.
 */
export declare function getJwksForPublication(data: DataAdapters, tenantId: string, modeOption: SigningKeyModeOption | undefined): Promise<{
    alg: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512" | "HS256" | "HS384" | "HS512";
    kid: string;
    kty: "RSA" | "EC" | "oct";
    use?: "sig" | "enc" | undefined;
    n?: string | undefined;
    e?: string | undefined;
    crv?: string | undefined;
    x?: string | undefined;
    y?: string | undefined;
    x5t?: string | undefined;
    x5c?: string[] | undefined;
}[]>;
