import { type ClientAssertionPrivateJwk, type PublicJwk } from '@atcute/oauth-crypto';
import type { KeySearchOptions } from './types.ts';
/** a collection of private keys for client authentication. */
export declare class Keyset {
    private readonly keys;
    private _publicJwks;
    /**
     * creates a new keyset from an array of private JWKs.
     *
     * @param keys array of private JWKs (at least one required, each with `kid` and `alg` set)
     * @throws if keyset is empty or contains duplicate key IDs
     */
    constructor(keys: ClientAssertionPrivateJwk[]);
    /** number of keys in the keyset */
    get size(): number;
    /** public JWKS for serving at client metadata or jwks_uri. derived lazily on first access, then cached. */
    get publicJwks(): {
        keys: readonly PublicJwk[];
    };
    /**
     * finds the first key matching the given criteria.
     *
     * @param options search criteria (kid and/or alg)
     * @returns matching key or undefined
     */
    find(options?: KeySearchOptions): ClientAssertionPrivateJwk | undefined;
    /**
     * gets a key matching the given criteria.
     *
     * @param options search criteria (kid and/or alg)
     * @returns matching key
     * @throws if no matching key is found
     */
    get(options?: KeySearchOptions): ClientAssertionPrivateJwk;
    /**
     * iterates over keys matching the given criteria, in preference order.
     *
     * @param options search criteria (kid and/or alg)
     */
    list(options?: KeySearchOptions): Generator<ClientAssertionPrivateJwk>;
    /**
     * finds a key for signing, negotiating algorithm with server's supported list.
     *
     * @param serverAlgs algorithms supported by the server (from metadata)
     * @returns key and negotiated algorithm
     * @throws if no compatible key is found
     */
    findForSigning(serverAlgs?: readonly string[]): {
        key: ClientAssertionPrivateJwk;
        alg: string;
    };
    [Symbol.iterator](): Iterator<ClientAssertionPrivateJwk>;
}