import { IPerformanceClient, Logger } from "@azure/msal-common/browser";
import type { ITokenBindingKeyManager, TokenBindingKeyProvisioningParameters } from "@azure/msal-common/browser";
/**
 * Browser keystore record for asymmetric token-binding keys.
 */
export type CachedKeyPair = {
    /**
     * Public WebCrypto key.
     */
    publicKey: CryptoKey;
    /**
     * Private WebCrypto key used for signing.
     */
    privateKey: CryptoKey;
    /**
     * Protocol or token-binding family that owns the key.
     */
    tokenBindingKeyType?: string;
    /**
     * JOSE algorithm policy associated with the key.
     */
    tokenBindingKeyAlgorithm?: string;
    /**
     * JWK thumbprint used as the key identifier.
     */
    keyId?: string;
};
/**
 * Token-binding key metadata emitted in performance measurements.
 */
export type TokenBindingKeyTelemetry = {
    /**
     * Protocol or token-binding family that owns the key.
     */
    tokenBindingKeyType?: string;
    /**
     * JOSE algorithm policy associated with the key.
     */
    tokenBindingKeyAlgorithm?: string;
};
/**
 * Owns browser token-binding key lifecycle and storage lookup.
 * @internal
 */
export declare class TokenBindingKeyManager implements ITokenBindingKeyManager {
    private static TOKEN_BINDING_KEY_USAGES;
    private static tokenBindingKeyStorage;
    private cache;
    private logger;
    private performanceClient;
    constructor(logger: Logger, performanceClient?: IPerformanceClient);
    private static getTokenBindingKeyStorage;
    /**
     * Provisions a browser token-binding key and returns its key identifier.
     * @param request - Key provisioning policy.
     */
    provisionTokenBindingKey(request: TokenBindingKeyProvisioningParameters): Promise<string>;
    /**
     * Removes a browser token-binding key by identifier.
     * @param kid - Token-binding key identifier.
     * @param correlationId - Request correlation identifier.
     */
    removeTokenBindingKey(kid: string, correlationId: string): Promise<void>;
    /**
     * Clears browser token-binding keys from memory and persistent storage.
     * @param correlationId - Request correlation identifier.
     */
    clearKeystore(correlationId: string): Promise<boolean>;
    /**
     * Gets a token-binding public key as a JWK by identifier.
     * @param keyId - Token-binding key identifier.
     * @param correlationId - Request correlation identifier.
     */
    getTokenBindingPublicKeyJwk(keyId: string, correlationId: string): Promise<JsonWebKey>;
    private createTokenBindingKey;
    private generateKeyPairAndThumbprint;
    /** @internal */
    getTokenBindingKeyPair(keyId: string, correlationId: string): Promise<CachedKeyPair>;
    /** @internal */
    getTokenBindingKeyTelemetry(cachedKeyPair: CachedKeyPair, fallbackAlgorithm?: string): TokenBindingKeyTelemetry;
    private getTokenBindingKeyGenAlgorithmOptions;
}
//# sourceMappingURL=TokenBindingKeyManager.d.ts.map