import type { PrivateKeyUsage } from './jwk.js';
import type { JwksPub } from './jwks.js';
import type { VerifyOptions, VerifyResult } from './jwt-verify.js';
import type { JwtHeader, JwtPayload, SignedJwt } from './jwt.js';
import type { ActivityCheckOptions, Key, KeyMatchOptions } from './key.js';
import { type Override } from './util.js';
export type { ActivityCheckOptions, KeyMatchOptions };
export type FindKeyOptions = KeyMatchOptions & ActivityCheckOptions;
export type JwtSignHeader = Override<JwtHeader, Pick<FindKeyOptions, 'alg' | 'kid'>>;
export type JwtPayloadGetter<P = JwtPayload> = (header: JwtHeader, key: Key) => P | PromiseLike<P>;
export declare class Keyset<K extends Key = Key> implements Iterable<K> {
    /**
     * The preferred algorithms to use when signing a JWT using this keyset.
     *
     * @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1}
     */
    readonly preferredSigningAlgorithms: readonly string[];
    private readonly keys;
    constructor(iterable: Iterable<K | null | undefined | false>, 
    /**
     * The preferred algorithms to use when signing a JWT using this keyset.
     *
     * @see {@link https://datatracker.ietf.org/doc/html/rfc7518#section-3.1}
     */
    preferredSigningAlgorithms?: readonly string[]);
    get size(): number;
    get signAlgorithms(): readonly string[];
    get publicJwks(): Readonly<{
        keys: readonly (Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "RSA";
            alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
            n: string;
            e: string;
            d?: string | undefined;
            p?: string | undefined;
            q?: string | undefined;
            dp?: string | undefined;
            dq?: string | undefined;
            qi?: string | undefined;
            oth?: {
                r?: string | undefined;
                d?: string | undefined;
                t?: string | undefined;
            }[] | undefined;
        } & {
            kid: NonNullable<unknown>;
        } & {
            d?: never;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "EC";
            alg?: "ES256" | "ES384" | "ES512" | undefined;
            crv: "P-256" | "P-384" | "P-521";
            x: string;
            y: string;
            d?: string | undefined;
        } & {
            kid: NonNullable<unknown>;
        } & {
            d?: never;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "EC";
            alg?: "ES256K" | undefined;
            crv: "secp256k1";
            x: string;
            y: string;
            d?: string | undefined;
        } & {
            kid: NonNullable<unknown>;
        } & {
            d?: never;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "OKP";
            alg?: "EdDSA" | undefined;
            crv: "Ed25519" | "Ed448";
            x: string;
            d?: string | undefined;
        } & {
            kid: NonNullable<unknown>;
        } & {
            d?: never;
        }>)[];
    }>;
    get privateJwks(): Readonly<{
        keys: readonly (Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "RSA";
            alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
            n: string;
            e: string;
            d?: string | undefined;
            p?: string | undefined;
            q?: string | undefined;
            dp?: string | undefined;
            dq?: string | undefined;
            qi?: string | undefined;
            oth?: {
                r?: string | undefined;
                d?: string | undefined;
                t?: string | undefined;
            }[] | undefined;
        } & {
            k: NonNullable<unknown>;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "RSA";
            alg?: "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" | undefined;
            n: string;
            e: string;
            d?: string | undefined;
            p?: string | undefined;
            q?: string | undefined;
            dp?: string | undefined;
            dq?: string | undefined;
            qi?: string | undefined;
            oth?: {
                r?: string | undefined;
                d?: string | undefined;
                t?: string | undefined;
            }[] | undefined;
        } & {
            d: NonNullable<unknown>;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "EC";
            alg?: "ES256" | "ES384" | "ES512" | undefined;
            crv: "P-256" | "P-384" | "P-521";
            x: string;
            y: string;
            d?: string | undefined;
        } & {
            k: NonNullable<unknown>;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "EC";
            alg?: "ES256" | "ES384" | "ES512" | undefined;
            crv: "P-256" | "P-384" | "P-521";
            x: string;
            y: string;
            d?: string | undefined;
        } & {
            d: NonNullable<unknown>;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "EC";
            alg?: "ES256K" | undefined;
            crv: "secp256k1";
            x: string;
            y: string;
            d?: string | undefined;
        } & {
            k: NonNullable<unknown>;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "EC";
            alg?: "ES256K" | undefined;
            crv: "secp256k1";
            x: string;
            y: string;
            d?: string | undefined;
        } & {
            d: NonNullable<unknown>;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "OKP";
            alg?: "EdDSA" | undefined;
            crv: "Ed25519" | "Ed448";
            x: string;
            d?: string | undefined;
        } & {
            k: NonNullable<unknown>;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "OKP";
            alg?: "EdDSA" | undefined;
            crv: "Ed25519" | "Ed448";
            x: string;
            d?: string | undefined;
        } & {
            d: NonNullable<unknown>;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "oct";
            alg?: "HS256" | "HS384" | "HS512" | undefined;
            k: string;
        } & {
            k: NonNullable<unknown>;
        }> | Readonly<{
            kid?: string | undefined;
            use?: "enc" | "sig" | undefined;
            key_ops?: ("decrypt" | "deriveBits" | "deriveKey" | "encrypt" | "sign" | "unwrapKey" | "verify" | "wrapKey")[] | undefined;
            x5c?: string[] | undefined;
            x5t?: string | undefined;
            'x5t#S256'?: string | undefined;
            x5u?: string | undefined;
            ext?: boolean | undefined;
            iat?: number | undefined;
            exp?: number | undefined;
            nbf?: number | undefined;
            revoked?: {
                revoked_at: number;
                reason?: string | undefined;
            } | undefined;
            kty: "oct";
            alg?: "HS256" | "HS384" | "HS512" | undefined;
            k: string;
        } & {
            d: NonNullable<unknown>;
        }>)[];
    }>;
    has(kid: string): boolean;
    get(options: FindKeyOptions): K;
    find(options: FindKeyOptions): K | undefined;
    list<O extends FindKeyOptions>(options: O): Generator<K, void, unknown>;
    findPrivateKey({ kid, alg, usage, ...options }: FindKeyOptions & {
        usage: PrivateKeyUsage;
    }): {
        key: Key;
        alg: string;
    };
    [Symbol.iterator](): IterableIterator<K>;
    createJwt({ alg: sAlg, kid: sKid, ...header }: JwtSignHeader, payload: JwtPayload | JwtPayloadGetter): Promise<SignedJwt>;
    verifyJwt<C extends string = never>(token: SignedJwt, options?: ActivityCheckOptions & VerifyOptions<C>): Promise<VerifyResult<C> & {
        key: K;
    }>;
    toJSON(): JwksPub;
}
//# sourceMappingURL=keyset.d.ts.map