/// <reference types="node" />
/// <reference types="node" />
import { GraphSubject, Reference } from '@m-ld/m-ld';
import { KeyObject } from 'crypto';
import { AuthKey, AuthKeyConfig, Key } from '../lib/index.js';
import { JwtHeader, SignOptions } from 'jsonwebtoken';
export interface UserKeyConfig extends AuthKeyConfig {
    key: {
        type: 'rsa';
        public: string;
        private?: string;
    };
}
/**
 * User Key details, appears in:
 * 1. Gateway domain, with all details
 * 2. Timesheet domains, without private key (for sig verify)
 * 3. Client configuration, without revocation (assumed true)
 */
export declare class UserKey implements Key {
    /**
     * From m-ld subject representation
     */
    static fromJSON(src: GraphSubject): UserKey;
    /**
     * From client config – no name or revocation
     */
    static fromConfig(config: UserKeyConfig): UserKey;
    /**
     * @throws {TypeError} if the reference is not to a user key
     */
    static keyidFromRef(ref: Reference): string;
    /** @returns Reference */
    static refFromKeyid(keyid: string, domain?: string): {
        '@id': string;
    };
    static splitSignature(data: Uint8Array): [string | undefined, Uint8Array];
    static generate(authKey: AuthKey | string): UserKey;
    static encoding: {
        public: {
            type: string;
            format: string;
        };
        private: (authKey: AuthKey) => {
            type: string;
            format: string;
            cipher: string;
            passphrase: string;
        };
    };
    readonly keyid: string;
    readonly name?: string;
    readonly publicKey: Buffer;
    private readonly privateKey?;
    readonly revoked: boolean;
    constructor({ keyid, name, publicKey, privateKey, revoked }: {
        keyid: string;
        name?: string;
        publicKey: Uint8Array;
        privateKey?: Uint8Array;
        revoked?: boolean;
    });
    /**
     * @returns {boolean} `false` if the auth key does not correspond to this user key
     */
    matches(authKey: AuthKey): boolean;
    sign(data: Uint8Array, authKey: AuthKey): Buffer;
    verify(sig: Uint8Array, data: Uint8Array): boolean;
    /**
     * @returns {Promise<string>} JWT
     */
    signJwt(payload: string | Buffer | object, authKey: AuthKey, options?: SignOptions): Promise<string>;
    static verifyJwt(jwt: string, getUserKey: (header: JwtHeader) => Promise<UserKey>): Promise<import("jsonwebtoken").JwtPayload>;
    /**
     * @param {AuthKey} authKey
     * @returns {[string, KeyObject]} Arguments for HTTP signing
     * @see https://httpwg.org/http-extensions/draft-ietf-httpbis-message-signatures.html
     */
    getSignHttpArgs(authKey: AuthKey): [string, KeyObject];
    private getCryptoPrivateKey;
    getCryptoPublicKey(): KeyObject;
    /**
     * @param {boolean} excludePrivate `true` to exclude the private key
     * @returns {GraphSubject}
     */
    toJSON(excludePrivate?: boolean): any;
    /**
     * Note this is only a partial inverse of {@link fromConfig}:
     * - the user and domain are not included
     */
    toConfig(authKey: AuthKey): UserKeyConfig;
}