/**
 * Compute the JWK thumbprint per RFC 7638 §3, encoded as base64url.
 *
 * @param {object} jwk
 * @param {ThumbprintDigest} [digest='sha256']
 * @returns {Promise<string>}
 */
declare function thumbprint(jwk: object, digest?: ThumbprintDigest): Promise<string>;
/**
 * Compute the JWK Thumbprint URI per RFC 9278 §3:
 * `urn:ietf:params:oauth:jwk-thumbprint:sha-256:<thumbprint>`.
 *
 * @param {object} jwk
 * @param {ThumbprintDigest} [digest='sha256']
 * @returns {Promise<string>}
 */
declare function thumbprintURI(jwk: object, digest?: ThumbprintDigest): Promise<string>;
/**
 * Semantic-equality check via thumbprint. Two JWKs match when their
 * required members (per kty) produce the same digest, regardless of
 * `kid` / `use` / `alg` decoration — even when one is the private form
 * and the other the public projection.
 *
 * @param {object} a
 * @param {object} b
 * @param {ThumbprintDigest} [digest='sha256']
 * @returns {Promise<boolean>}
 */
declare function matches(a: object, b: object, digest?: ThumbprintDigest): Promise<boolean>;
type ThumbprintDigest = "sha256" | "sha384" | "sha512";

export { matches, thumbprint, thumbprintURI };
export type { ThumbprintDigest };