/**
 * Shared cryptographic utilities for SMART on FHIR authentication.
 *
 * Uses the Web Crypto API — works in Node.js 18+, Deno, CF Workers,
 * and modern browsers. base64url is sourced from `@babelfhir-ts/oauth-crypto`.
 *
 * @internal Exported for use by `BackendServicesAuth` and `ConfidentialClientAuth`.
 */
/** Signing algorithms mandated by the SMART `client-confidential-asymmetric` profile. */
export type SmartSigningAlgorithm = "RS384" | "ES384";
export interface ClientAssertionOptions {
    /** OAuth2 client_id registered with the FHIR server. */
    clientId: string;
    /** The token endpoint URL (used as `aud` in the JWT payload). */
    tokenEndpoint: string;
    /**
     * Private key for signing the assertion.
     * Accepts a PEM-encoded PKCS#8 string or a pre-imported `CryptoKey`.
     */
    privateKey: string | CryptoKey;
    /** Key ID — must match the `kid` in the registered JWKS. */
    keyId: string;
    /** Signing algorithm (default `ES384`). */
    algorithm?: SmartSigningAlgorithm;
    /** JWT lifetime in seconds (default 300, capped at 300 per spec). */
    lifetimeSeconds?: number;
}
/** Generate a cryptographically random base64url-encoded nonce. */
export declare function generateJti(): string;
export declare function pemToArrayBuffer(pem: string): ArrayBuffer;
export declare function importParams(alg: SmartSigningAlgorithm): RsaHashedImportParams | EcKeyImportParams;
export declare function signParams(alg: SmartSigningAlgorithm): AlgorithmIdentifier | EcdsaParams;
export declare function importPrivateKey(pem: string, alg: SmartSigningAlgorithm): Promise<CryptoKey>;
/**
 * Build a signed JWT client assertion per the SMART
 * `client-confidential-asymmetric` profile (§4.1.5.1).
 *
 * The same assertion format is used for:
 * - `authorization_code` token exchange (App Launch)
 * - `client_credentials` grant (Backend Services)
 * - `refresh_token` grant
 *
 * @see https://hl7.org/fhir/smart-app-launch/client-confidential-asymmetric.html
 *
 * @example
 * ```ts
 * const assertion = await buildClientAssertion({
 *   clientId: "my-app",
 *   tokenEndpoint: "https://auth.example.com/token",
 *   privateKey: process.env.PRIVATE_KEY!,
 *   keyId: "key-1",
 *   algorithm: "ES384",
 * });
 * ```
 */
export declare function buildClientAssertion(options: ClientAssertionOptions): Promise<string>;
//# sourceMappingURL=crypto.d.ts.map