/**
 * Coerce an input into an `X509Certificate`. Accepts:
 *   - an `X509Certificate` (returned unchanged)
 *   - a `Uint8Array` / `Buffer` of DER bytes
 *   - a PEM string
 *
 * @param {X509Certificate | Uint8Array | Buffer | string} input
 * @returns {X509Certificate}
 */
export function toCertificate(input: X509Certificate | Uint8Array | Buffer | string): X509Certificate;
/**
 * Convenience: coerce an array of mixed inputs.
 *
 * @param {Array<X509Certificate | Uint8Array | Buffer | string>} inputs
 * @returns {X509Certificate[]}
 */
export function toCertificates(inputs: Array<X509Certificate | Uint8Array | Buffer | string>): X509Certificate[];
/**
 * Verify a leaf-first certificate chain against a trust anchor set.
 *
 * Throws on any failure with a message that names the offending
 * position in the chain. Returns silently on success.
 *
 * Algorithm:
 *   for each certificate in the chain (leaf → root):
 *     - reject if outside its validity window at `now`
 *     - stop if this certificate is itself in the anchor set
 *     - otherwise locate the signer — next in the chain, or, if
 *       we've exhausted the chain, an anchor whose subject matches
 *       this certificate's issuer
 *     - reject if no such signer exists
 *     - verify DN linkage (`checkIssued`) and cryptographic
 *       signature (`verify(publicKey)`) against the signer
 *
 * @param {object} params
 * @param {Array<X509Certificate | Uint8Array | Buffer | string>} params.x5c
 *   Leaf first. Must be non-empty.
 * @param {Array<X509Certificate | Uint8Array | Buffer | string>} params.trustAnchors
 *   Root and/or intermediate certificates the RP trusts. Empty means
 *   the chain has no acceptable termination — the call will always
 *   throw. Callers that want to skip chain validation should not
 *   call this function.
 * @param {Date} [params.now]  clock reference for validity checks
 */
export function verifyChain({ x5c, trustAnchors, now }: {
    x5c: Array<X509Certificate | Uint8Array | Buffer | string>;
    trustAnchors: Array<X509Certificate | Uint8Array | Buffer | string>;
    now?: Date | undefined;
}): void;