/**
 * Minimal ASN.1 DER parser for extracting certificates from a PKCS#7
 * "certs-only" SignedData structure, as returned by the EST
 * /.well-known/est/cacerts endpoint (RFC 7030).
 *
 * Structure:
 *   ContentInfo ::= SEQUENCE {
 *     contentType  OID (1.2.840.113549.1.7.2 = signedData),
 *     content      [0] EXPLICIT SignedData
 *   }
 *   SignedData ::= SEQUENCE {
 *     version          INTEGER,
 *     digestAlgorithms SET,
 *     encapContentInfo SEQUENCE,
 *     certificates     [0] IMPLICIT SET OF Certificate  (OPTIONAL),
 *     ...
 *   }
 */
/**
 * Parse a base64-encoded PKCS#7 DER blob (from EST /cacerts) and
 * return the embedded CA certificates as PEM strings.
 */
export declare function parsePkcs7Certs(base64Body: string): string[];