import { EcNamedCurve } from "../keys/keys.js";
import { VerifySignatureConfigFailure, VerifySignedDataFailure, VerifySignedDataResult, VerifySignedDataSuccess } from "../internal/crypto/sig-verify.js";
import { SignatureProfileInput } from "../internal/crypto/signing.js";
//#region src/crypto/crypto.d.ts
/** Input for {@linkcode verifySignature}. */
interface VerifySignatureInput {
  /** DER `SubjectPublicKeyInfo` of the signer (`subjectPublicKeyInfoDer` on a parsed certificate). */
  readonly signerSpkiDer: Uint8Array;
  /** The signature algorithm as carried beside the signature. */
  readonly signatureAlgorithm: {
    /** Dotted-decimal signature algorithm OID. */
    readonly oid: string;
    /** DER algorithm parameters when the algorithm carries them (RSA-PSS). */
    readonly parametersDer?: Uint8Array;
  };
  /** The signer's public key algorithm as carried in its SPKI. */
  readonly publicKeyAlgorithm: {
    /** Dotted-decimal public key algorithm OID. */
    readonly oid: string;
    /** Named-curve or scheme parameters OID, when present. */
    readonly parametersOid?: string;
  };
  /** The signature bytes. ECDSA accepts DER or raw encoding. */
  readonly signature: Uint8Array;
  /** The exact bytes the signature covers. */
  readonly data: Uint8Array;
}
/** Result of {@linkcode signData}: the signature plus its on-wire algorithm identity. */
interface SignDataResult {
  /** The signature bytes. ECDSA is DER `ECDSA-Sig-Value`, everything else raw. */
  readonly signature: Uint8Array;
  /** Dotted-decimal signature algorithm OID. */
  readonly algorithmOid: string;
  /** DER algorithm parameters when the algorithm carries them (NULL for PKCS#1 v1.5, RSA-PSS params). */
  readonly parametersDer?: Uint8Array;
}
/**
 * Verifies a detached signature against the signer's DER `SubjectPublicKeyInfo`.
 *
 * Supports RSA PKCS#1 v1.5 (SHA-256/384/512), RSA-PSS with parsed parameters,
 * ECDSA P-256/P-384/P-521, and Ed25519. When an ECDSA signature fails to
 * verify under one encoding, the alternate DER/raw encoding is retried.
 *
 * Returns a typed union: `{ ok: true, valid }` when verification ran,
 * `unsupported_signature_algorithm_parameters` or `verification_error`
 * failures otherwise.
 */
declare function verifySignature(input: VerifySignatureInput): Promise<VerifySignedDataResult>;
/**
 * Signs `data` with a WebCrypto private key and returns the signature beside
 * the resolved `AlgorithmIdentifier` material for embedding in a signed
 * structure.
 *
 * The algorithm is inferred from the key (RSASSA-PKCS1-v1_5, ECDSA, Ed25519);
 * RSA-PSS keys require an explicit `{ kind: 'rsa-pss' }` profile. ECDSA
 * signatures are returned DER-encoded. Throws on unsupported key algorithms.
 */
declare function signData(privateKey: CryptoKey, data: Uint8Array, profile?: SignatureProfileInput): Promise<SignDataResult>;
/**
 * Converts a DER `ECDSA-Sig-Value` (RFC 5480: SEQUENCE of INTEGERs r and s)
 * to the fixed-width raw `r || s` encoding WebCrypto and JOSE use.
 * Throws on malformed DER or integers too large for the curve.
 */
declare function ecdsaSignatureDerToRaw(signature: Uint8Array, curve: EcNamedCurve): Uint8Array;
/**
 * Converts a fixed-width raw `r || s` ECDSA signature to the DER
 * `ECDSA-Sig-Value` encoding X.509 and CMS structures embed.
 * Throws when the input length does not match the curve.
 */
declare function ecdsaSignatureRawToDer(signature: Uint8Array, curve: EcNamedCurve): Uint8Array;
//#endregion
export { SignDataResult, type SignatureProfileInput, type VerifySignatureConfigFailure, VerifySignatureInput, type VerifySignedDataFailure, type VerifySignedDataResult, type VerifySignedDataSuccess, ecdsaSignatureDerToRaw, ecdsaSignatureRawToDer, signData, verifySignature };
//# sourceMappingURL=crypto.d.ts.map