/**
 * OAuth RSA Key Management
 *
 * Generates, stores, loads, and caches an RS256 key pair for signing JWT
 * access tokens. The key is stored in the OAuthSigningKey table so all
 * Harper worker threads share the same key.
 */
import { type JWK } from 'jose';
/**
 * Ensure a signing key exists. Loads from DB or generates a new one.
 * Called once during handleApplication() on each worker thread.
 */
export declare function ensureSigningKey(): Promise<void>;
/**
 * Get the private key for signing JWTs.
 * Lazily initializes if not yet loaded.
 */
export declare function getPrivateKey(): Promise<CryptoKey>;
/**
 * Get the public key JWK for token verification and JWKS endpoint.
 * Lazily initializes if not yet loaded.
 */
export declare function getPublicKeyJwk(): Promise<JWK>;
/**
 * Get the key ID for the JWT header.
 */
export declare function getKeyId(): string;
/**
 * Get the JWKS response body for the /oauth/jwks endpoint.
 */
export declare function getJwks(): Promise<{
    keys: JWK[];
}>;
//# sourceMappingURL=keys.d.ts.map